Uninstall & offboarding

Device retirement has several separate parts: local collector/service, agent hook entries, workspace identity, stored history, and any browser extension or MDM enrollment. Choose the scope deliberately and preserve required evidence before deleting data.

Disconnect the workspace

beam logout

This attempts to revoke the enrolled device remotely and clears local identity even if the server is unreachable. Check the Agents page to confirm revocation after a network failure. Logout does not delete existing workspace history, all local data, or every cached policy file.

If you only want to stop collection temporarily, stop the foreground process or use beam service stop. Agent hook configuration can remain installed and report capture errors while the collector is stopped.

Export evidence first

Use the authenticated local export before removal if retained events are needed for an investigation. Review and protect the output. Ask a workspace administrator to export relevant audit records separately; local event export and administrative audit are different data sets.

Keep response-worker receipts and MDM operation history under the endpoint offboarding procedure. CLI removal does not replace MDM response reconciliation.

Remove the CLI installation

beam uninstall

Read and confirm the removal summary. The command attempts to stop/remove the service, remove Beam hook entries from supported agent configuration, revoke the registered device, delete the Beam configuration/data directories, and uninstall global Beam packages.

--keep-package retains the packages while removing the other local state. --yes bypasses the confirmation for an already-authorized automated workflow. Check BEAM_HOME and BEAM_DATA_DIR before using full uninstall: the configured directories are deletion targets.

Verify the outcome

Review the command output for skipped service removal, package-uninstall failures, or remote revocation failures. Verify no collector process remains, the agent configs no longer contain Beam's hook entries, and the workspace registration is revoked. A final local success message does not override an earlier unreachable-server warning.

Remove other components separately

Remove Beam Sentinel through Chrome's extension management. Unenroll operating-system management through the approved provider process. For Windows Beam response, revoke the binding, unregister its task, and archive receipts before removing protected files. Disabling a response channel cannot revoke a device action already accepted by the OS.