# How to stop Elastic Endpoint

**URL:** <https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283>\
**Category:** Endpoint Security\
**Created:** [March 15, 2021, 3:35pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283 "2021-03-15T15:35:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [March 15, 2021, 3:35pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/1 "2021-03-15T15:35:23Z")

</div>

Hello,

I am testing elastic Endpoint, I have installed it in a windows server machine, and when I try to install a malware in my machine it blocks it as expected so it works perfectly, The only problem is that I am not receiving anything in my SIEM.

I would like to uninstall it or stop it to install it again with a new `enroll` but even as an admin I coudln't stop it.

Could you tell me please how can I do in this case ?  
Thanks for your help

---

<div class="post-metadata">

**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\
**Post date:** [March 15, 2021, 4:10pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/2 "2021-03-15T16:10:16Z")

</div>

Hi @TheHunter1. If you change your Agent to a policy without the Endpoint Security integration, Agent should uninstall Endpoint.

If Agent is no longer running on the machine, you can uninstall the Elastic Endpoint by running the following command as an Administrator. In the future we may add the ability for administrators to make local uninstallation more difficult.

```
"%PROGRAMFILES%\Elastic\Endpoint\elastic-endpoint.exe" uninstall
```

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [March 15, 2021, 4:52pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/3 "2021-03-15T16:52:53Z")

</div>

Thanks a lot @gabriel.landau, I could uninstall it using the command that you gave me and install it again and now it's working perfectly.

Yes It would be better for example to be able to add a password to the endpoint, and can't stop it even when we are admin unless if we have the password or something like that

Thanks for your great work 🙂

---

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [March 15, 2021, 4:58pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/4 "2021-03-15T16:58:23Z")

</div>

The only problem is that using `firefox` browser I can see the number of events sent by the Endpoint, and using `chrome` I can't see that !

As you can see in these pics:

**Firefox**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/2226006ea9af217d6ff2ab8c372ce93178b44c14.png)

**Google Chrome**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6987dc206ca1ca84c3bef6f9966381e23c46dd57.png)

**NB:** I am testing the trial version of 8.0.0 (source)

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [March 15, 2021, 7:18pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/5 "2021-03-15T19:18:48Z")

</div>

Testing locally I don't see any difference between browsers. They're not doing anything odd/different from each other. They both send an aggregation that has counts for everything and returns the hits so it would be odd that one browser would skip those numbers vs. another browser. There's nothing browser specific.

> I am testing the trial version of 8.0.0 (source)

What does this mean?

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [March 15, 2021, 11:40pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/6 "2021-03-15T23:40:05Z")

</div>

Also (just thought of this btw), for each browser check your data sources button as they might have changed between browsers which would show this oddness between the two:

 ![Screen Shot 2021-03-15 at 3.32.06 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0c71576da3839837e472c6e2379d00e1bb6cc03d.png)

Make sure that's the same between the two browsers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2021, 11:40pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283/7 "2021-04-12T23:40:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
