12.8 Removal
Tamper protection (Policy → Rules → Agent Rules → Tamper protection) makes removal deliberate. With it on, even administrators cannot stop or delete the Windows services. Removal paths:
| Method | Platforms | Needs | Notes |
|---|---|---|---|
| Remote uninstall (Agents drawer, section 13.3.10) | Windows, macOS | Console administrator (plus your password if Issuing a remote agent uninstall is ticked under Settings → Security → Sign-in & access → Actions that require your password) | Executed on the next heartbeat. Irreversible. Needs no uninstall password on the machine. Best for mass removal. |
One-time token +
Ada.Uninstall.exe -token <token> |
Windows | Token from Generate one-time token in the drawer. It is bound to one machine and valid 24 hours. | For one-off scripted removals. Redirect stdin
(< NUL) in unattended jobs so the final “press any key”
cannot hang. |
Ada.Uninstall.exe with password |
Windows | The tamper-protection uninstall password (shared or group-specific); run elevated | Prompts Uninstall password: (3 attempts). Add/Remove
Programs points to the same tool. |
ada-agent uninstall --password-stdin |
macOS | The uninstall password (no admin rights needed). With tamper
protection off, run it with sudo. |
Or
curl -sk https://ada.example.com/macos-client-uninstall.sh \| bash.
5 wrong passwords in 15 minutes lock the gate for 15 minutes. |
What happens: - Windows. The tool writes an authorised request. The SYSTEM service then: - relaxes its own protection - deletes both services - unregisters the COM add-ins and the right-click menu - removes the files
The result is written outside the deleted tree to
%WINDIR%\Temp\ada-uninstall.log:
UNINSTALL VERIFIED: nothing left behind or
UNINSTALL INCOMPLETE: …. Ada.Uninstall.exe and
Ada.Classification.dll may remain, because they are still
running; this is benign. - macOS. The root daemon: -
removes the LaunchAgent definitions - for every local account, removes
the agent data, Quick Action, launcher and manifests - removes the app
bundle and the machine state, keeping agent-id so a
reinstall keeps the same console row - finally removes itself
The result is in
/Library/Logs/AdaClassification/ada-uninstall.log
(UNINSTALL VERIFIED).
Audit events: - uninstall_token_issued -
uninstall_authorized - uninstall_completed -
uninstall_attempt_failed