Skip to main content

Create a Device Level Windows Disable Agent Uninstall Protection Policy

Use the Disable Agent Uninstall Protection policy for Windows to allow standard uninstalls without a maintenance token on specific Windows devices. By default, Agent Uninstall Protection is always on for JumpCloud-managed Windows devices that have the agent installed, requiring a per-device maintenance token to uninstall the agent. Apply this policy to temporarily disable protection for agent maintenance, troubleshooting, imaging workflows, or any Windows devices where you don’t need uninstall protection.

note

This is a device-level policy that applies system-wide to the device and all of its users. You can bind this policy to individual devices or device groups. The policy name is Disable Agent Uninstall Protection on every OS; select the Windows tab when you create it.

Important

An exempted device does not prompt for a maintenance token, reports its protection status as Off, and JumpCloud does not log uninstall events in Directory Insights. Plan exemptions narrowly.

Prerequisites:

Considerations:

  • To apply a policy to a device, the device must be running on a supported OS. Before you assign a policy, follow the instructions in Get Started: Devices.
  • To apply a policy to a group of devices, you must define device groups. Before you assign a policy, follow the instructions in Get Started: Groups.
  • Policy creation, edits, deletions, and assignment changes are recorded as audit events in Directory Insights. When Agent Uninstall Protection is disabled, JumpCloud does not log uninstall events in Directory Insights.
  • The policy takes effect when the JumpCloud agent next checks in. Protection remains disabled for as long as this policy is bound to the device or device group. Removing the policy restores agent protection on the next agent check-in.

Creating the Policy​

To create a Disable Agent Uninstall Protection policy for Windows devices, do the following:

Selecting the Policy Template​

  1. Log in to the JumpCloud Admin Portal.
Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

  1. Go to Device Management > Policy Management. The Policy Management page is displayed.
  2. On the Policy Management page, click + Add New.
  3. Select Device Policy to assign the policy to devices and device groups. On the New Device Policy page:
    • Select the Windows tab.
    • Search for Disable Agent Uninstall Protection (for example, search agent uninstall), select the policy, and click Configure. The Details tab of the policy is displayed.
    • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
    • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy​

This policy does not have configurable settings. Review the policy behavior on the Details tab, then associate a device or device group and save the policy to disable Agent Uninstall Protection.

When the policy is applied:

  • Admins can uninstall or reconfigure the JumpCloud agent on those devices without a maintenance token.
  • Devices remain managed in JumpCloud while the policy is applied.
  • Removing the policy restores agent protection on the next agent check-in.

Applying the Policy​

  1. (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy.
  2. Select the Device Groups tab. Select one or more device groups where you want to apply this policy. For device groups with multiple OS member types, the policy only applies to supported Windows devices in the group.
  3. Or, select the Devices tab. Select one or more devices where you want to apply this policy.
  4. Click save. A success message appears.

Viewing Policy Status​

  1. Select the Status tab.
  2. To see the last Result Log for a device where this policy is applied, click view.

After you save the policy, it may take a few minutes for the device to enforce it. You can view its status to determine if it applied successfully or if additional steps are needed.

note

If any errors occur, they're listed in Exit Status. If you have an Exit Status of 0, no errors occurred when applying or enforcing this policy.

Verifying the Agent Uninstall Protection Status​

See Accessing Agent Uninstall Protection in Get Started: Agent Uninstall Protection to learn more.

Removing the Exemption​

Removing the policy or the group assignment re-enables Agent Uninstall Protection on associated Windows devices, and uninstalls will again require a maintenance token.

  1. From the JumpCloud Admin Portal, go to Device Management > Policy Management.
  2. Select the Disable Agent Uninstall Protection Windows policy.
  3. Do one of the following:
    • Click the Device Groups tab, clear the checkboxes next to the device groups you want to resume protection, then click Save.
    • Click the Devices tab and clear checkboxes next to the devices you want to resume protection, then click Save.
    • Optionally, you can delete the policy which resumes protection on any associated devices.

Learn More​

Was this information helpful?