elastic / elastic/elastic-agent

[Fleet] Windows ARM: 64-bit agent installs without architecture check and subsequent uninstall leaves agent in a broken Offline state

Open
#14,518 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug impact:high Team:Elastic-Agent-Control-Plane
Dominant language
Go
Stars
276
Forks
266
Avg merge
1d 23h
Merged PRs (30d)
312

Description

**Kibana Build details:**
```
VERSION: 9.5.0 SNAPSHOT
BUILD: 103621
COMMIT: bd1ffae8026f28c0e0ad949a1e17624cbc98780f
```

**Host OS and Browser version:** Windows on ARM (ARM64 endpoint), All browsers

**Preconditions:**
1. 9.5.0 SNAPSHOT Kibana cloud environment should be available.
2. A Windows ARM64 endpoint (emulated architecture) should be available.
3. The 64-bit (x86_64) Elastic Agent 9.5.0 artifact should be downloaded for installation.

**Steps to reproduce:**
1. On the Windows ARM endpoint, install the 64-bit (x86_64) Elastic Agent 9.5.0 artifact.
2. Enroll the agent into Fleet and add the **Elastic Defend** and **System** integrations to the policy.
3. In Kibana, navigate to **Fleet → Agents → → Agent details** and observe the integration status.
4. Check the **Elastic Defend** integration status — it correctly shows `Elastic Defend cannot be installed on an emulated architecture.`
5. Check the **System** integration status — no failure or error message is displayed, even though the underlying architecture is unsupported.
6. Attempt to uninstall the agent from the endpoint:
- Open an elevated PowerShell prompt.
- Run: `& 'C:\Program Files\Elastic\Agent\elastic-agent.exe' uninstall`
- Confirm with `Y` when prompted.
7. After the uninstall completes, inspect `C:\Program Files\Elastic\Agent` on the endpoint and the agent state in the Kibana Fleet UI.

**Impacted Area:**
- Installation of the x86_64 agent on an ARM endpoint is **not blocked**, even though the architecture is unsupported.
- The subsequent `elastic-agent uninstall` does not complete cleanly:
- Some files/folders remain under `C:\Program Files\Elastic\Agent`.
- In Kibana, the agent transitions to an **Offline** state instead of going to uninstalled state.
- This leaves the Elastic Agent on the VM in a broken/half-installed state.

**Expected Result:**
- When a user installs the 64-bit agent artifact on an ARM endpoint, installation should fail upfront with a clear architecture-mismatch error (consistent with what Elastic Defend reports), and the **System** integration should also surface an appropriate failure/error message in the UI.
- **OR**
- If install-time blocking is not feasible, the `elastic-agent uninstall` command must complete successfully on the ARM endpoint — fully removing all files under `C:\Program Files\Elastic\Agent` and cleanly deregistering the agent from Fleet (not leaving it Offline).

**Screenshots / Recording:**

1. Agent Details tab showing the Elastic Defend architecture error:

Image

2. System integration section showing no error:
System integration with no error

3. CLI output during the failed uninstall:
CLI output during failed uninstall

4. Kibana Fleet UI showing the agent stuck in Offline state:
Agent stuck Offline in Fleet UI

5. `C:\Program Files\Elastic\Agent` contents remaining after uninstall:

https://github.com/user-attachments/assets/51695042-35bf-478d-abb6-6bc1523f0610

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce on a Windows ARM64 endpoint using the 64-bit Elastic Agent artifact, then inspect the `elastic-agent.exe uninstall` entry point and the Fleet → Agents UI. Compare the installation, System integration, and uninstall behavior with the expected architecture-mismatch handling. Done means installation is blocked with a clear error, or uninstall removes `C:\Program Files\Elastic\Agent` and deregisters the agent instead of leaving it Offline.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, powershell
Domain
devops, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.