Repair and uninstall
Repairing a broken installation, replacing a quarantined binary, and removing the agent or the CA connector from a host.
Repair
Repair re-registers the services including restart-on-failure, refreshes the Apps & Features entries, reinstalls the tray icon, makes sure the Update Service is present, and re-adds the CA connector's inbound firewall rule. It uses the credentials already on the host, so no token is needed.
.\aethercert-installer-windows-amd64.exe repair
.\aethercert-installer-windows-amd64.exe repair --redownload
.\aethercert-installer-windows-amd64.exe repair --component ca_connector| Flag | What it does |
|---|---|
--component agent|ca_connector | Repair only that one. Default: everything found on this host. |
--redownload | Also replace the installed binaries with the current build from the control plane. |
--no-tray, --no-update-service, --no-firewall-rule | Skip that companion or that rule. |
--lang en|de, --quiet | As on install. |
--redownload is the fix for a binary an endpoint-protection product removed or
quarantined. Plain repair is the fix for a service registration that was lost - after a
partial uninstall, or an interrupted migration that left the binary in place with no
service behind it.
Repair also re-adds the CA connector's firewall rule, which is worth knowing if a hardening pass removed it.
What to check first
aethercert-installer status prints each installed component, its version, its service
state, whether its binary and config are actually present, and which control plane it
points at. It exits 0 either way, so it is safe from a monitoring check or a
configuration-management dry run.
Uninstall
# Linux, as root - removes just this component's service.
aethercert-agent uninstall# Windows, as Administrator - everything found on this host.
.\aethercert-installer-windows-amd64.exe uninstall --all| Form | Removes |
|---|---|
uninstall --all | Every aethercert component present on the host. |
uninstall --agent --connector --update-service | Name them individually. At least one is required. |
--purge | Also deletes the binaries, configuration and logs. |
aethercert-agent uninstall | Just the fleet agent's own service. On Windows this is exactly what clicking Uninstall in Apps & Features runs. |
aethercert-ca-connector uninstall | Just the connector's service. |
aethercert-update-service uninstall | Just the Update Service. |
Without --purge, the binary and configuration stay in place, so a later install reuses
this host's existing enrollment instead of needing a fresh token. With --purge, a later
install needs a new token.
The setup window offers the same choice as a checkbox.
Uninstalling is not revoking
Uninstalling removes the software. It does not invalidate the host's credential. For a server that is gone for good, also revoke the agent under Manage > Agents - and do that first, since a decommissioned host is not available to uninstall from.
Certificates already deployed - files on disk, entries in the Windows certificate store - are never touched by an uninstall. Removing the agent stops management; it does not remove certificates the host is serving.
Removing an agent from the dashboard
| Action | Effect |
|---|---|
| Revoke | The agent can no longer authenticate or collect jobs, immediately. It stays in the list. The host has to be re-enrolled to come back. |
| Delete | Removes the record. Refused while certificates still target it - reassign or delete those first. |
See Agents.
Re-registering instead of reinstalling
If the problem is that a host's credentials were lost or rejected, you do not need to uninstall. Re-register on the agent's page in the dashboard mints a token scoped to that one agent; running the install command again updates its credentials in place. Certificates, history and group membership are unchanged.
Containers and manual setups
Running the agent without registering an operating-system service - in a container, or under your own process supervisor.
Agent configuration
The agent's config.json: what is in it, the two settings that are only configurable there, and what belongs in the dashboard instead.