Remove the Microsoft Defender for Identity sensor

This article describes how to uninstall the Microsoft Defender for Identity sensor from domain controllers. Use these procedures when you need to decommission a domain controller, clean up orphaned or duplicate sensor entries, or stop Defender for Identity monitoring on a specific server.

Delete a sensor

For sensor v3.x

To delete a v3.x sensor from the Microsoft Defender portal, follow these steps:

1. In the Microsoft Defender portal, go to Settings > Identities > Sensors.

2. Select the domain controller where you want to deactivate Defender for Identity capabilities, select Delete, and confirm your selection.

   

   Note

   Deleting the sensor removes the v3.x sensor software and stops monitoring on that domain controller.

Delete and uninstall a sensor v2.x from a domain controller

1. Sign in to the domain controller with administrative privileges.
2. From the Windows Start menu, select Settings > Control Panel > Add/ Remove Programs.
3. Select the sensor installation, select Uninstall, and follow the instructions to remove the sensor.
4. After the uninstall finishes, open the Microsoft Defender portal.
5. Go to Settings > Identities > Sensors.
6. Select the domain controller, and then select Delete.

Remove an orphaned sensor

A sensor can be orphaned when a domain controller was deleted without first uninstalling the sensor, and the sensor still appears in the Microsoft Defender portal.

1. In the Defender portal, go to Settings and then Identities. Select Sensors on the left to display all your Defender for Identity sensors.

2. Locate the orphaned sensor and select Delete (trash can icon).

   

Remove a duplicate sensor

A duplicate sensor entry can appear after an in-place sensor upgrade, where the sensor is listed twice in the Microsoft Defender portal.

1. In Defender portal, go to Settings and then Identities. Select Sensors on the left to display all your Defender for Identity sensors.
2. Locate the duplicate sensor. It will be the one whose status is set to Unknown. Then, at the end of the row, select Delete (trash can icon).

Uninstall the Defender for Identity sensor silently

Use the following command to perform a silent uninstall of the Defender for Identity sensor:

Syntax:

The following command shows the available options for removing the sensor from the command line, including optional silent and help switches.

"Azure ATP sensor Setup.exe" [/quiet] [/Uninstall] [/Help]

Installation options:

Examples:

To silently uninstall the Defender for Identity sensor from the server:

"Azure ATP sensor Setup.exe" /quiet /uninstall

See also

• Manage and update Microsoft Defender for Identity sensors