Elastic Uninstallation Guide
Elastic should not be removed.
There may be a need to uninstall Elastic (perhaps to reinstall the software, for example). This process may be made a little more complicated by Elastic's Agent Tamper Protection.
From a security perspective, this is a necessity to ensure agent resiliency from unauthorized changes, possibly including malicious attempts.
Uninstall Token
The Agent Tamper Protection requires an additional code to be provided so that one can uninstall Elastic. This additional piece of information is an uninstall token. There is one uninstall token per policy. Elastic's latest documentation on the topic can be found here: Uninstall Elastic Agent | Elastic Docs
Windows
C:\"Program Files"\Elastic\Agent\elastic-agent.exe uninstall --uninstall-token <UNINSTALL_TOKEN_HERE>
Linux and Mac
sudo elastic-agent uninstall --uninstall-token <UNINSTALL_TOKEN_HERE>
Requesting the Uninstall Token
For questions you may contact endpoint-security@tamu.edu. Concerns with System controlled endpoints should be addressed with the System.