elastic / elastic/elastic-agent
[Fleet] Windows ARM: 64-bit agent installs without architecture check and subsequent uninstall leaves agent in a broken Offline state
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 276
- Forks
- 266
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 312
Description
**Kibana Build details:**
```
VERSION: 9.5.0 SNAPSHOT
BUILD: 103621
COMMIT: bd1ffae8026f28c0e0ad949a1e17624cbc98780f
```
**Host OS and Browser version:** Windows on ARM (ARM64 endpoint), All browsers
**Preconditions:**
1. 9.5.0 SNAPSHOT Kibana cloud environment should be available.
2. A Windows ARM64 endpoint (emulated architecture) should be available.
3. The 64-bit (x86_64) Elastic Agent 9.5.0 artifact should be downloaded for installation.
**Steps to reproduce:**
1. On the Windows ARM endpoint, install the 64-bit (x86_64) Elastic Agent 9.5.0 artifact.
2. Enroll the agent into Fleet and add the **Elastic Defend** and **System** integrations to the policy.
3. In Kibana, navigate to **Fleet → Agents → → Agent details** and observe the integration status.
4. Check the **Elastic Defend** integration status — it correctly shows `Elastic Defend cannot be installed on an emulated architecture.`
5. Check the **System** integration status — no failure or error message is displayed, even though the underlying architecture is unsupported.
6. Attempt to uninstall the agent from the endpoint:
- Open an elevated PowerShell prompt.
- Run: `& 'C:\Program Files\Elastic\Agent\elastic-agent.exe' uninstall`
- Confirm with `Y` when prompted.
7. After the uninstall completes, inspect `C:\Program Files\Elastic\Agent` on the endpoint and the agent state in the Kibana Fleet UI.
**Impacted Area:**
- Installation of the x86_64 agent on an ARM endpoint is **not blocked**, even though the architecture is unsupported.
- The subsequent `elastic-agent uninstall` does not complete cleanly:
- Some files/folders remain under `C:\Program Files\Elastic\Agent`.
- In Kibana, the agent transitions to an **Offline** state instead of going to uninstalled state.
- This leaves the Elastic Agent on the VM in a broken/half-installed state.
**Expected Result:**
- When a user installs the 64-bit agent artifact on an ARM endpoint, installation should fail upfront with a clear architecture-mismatch error (consistent with what Elastic Defend reports), and the **System** integration should also surface an appropriate failure/error message in the UI.
- **OR**
- If install-time blocking is not feasible, the `elastic-agent uninstall` command must complete successfully on the ARM endpoint — fully removing all files under `C:\Program Files\Elastic\Agent` and cleanly deregistering the agent from Fleet (not leaving it Offline).
**Screenshots / Recording:**
1. Agent Details tab showing the Elastic Defend architecture error:
2. System integration section showing no error:
3. CLI output during the failed uninstall:
4. Kibana Fleet UI showing the agent stuck in Offline state:
5. `C:\Program Files\Elastic\Agent` contents remaining after uninstall:
https://github.com/user-attachments/assets/51695042-35bf-478d-abb6-6bc1523f0610
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce on a Windows ARM64 endpoint using the 64-bit Elastic Agent artifact, then inspect the `elastic-agent.exe uninstall` entry point and the Fleet → Agents UI. Compare the installation, System integration, and uninstall behavior with the expected architecture-mismatch handling. Done means installation is blocked with a clear error, or uninstall removes `C:\Program Files\Elastic\Agent` and deregisters the agent instead of leaving it Offline.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, powershell
- Domain
- devops, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100