elastic / elastic/kibana

[Fleet] Surface MSI-specific uninstall command for Windows agents installed via MSI

Open
#284,635 1 comment 0 reactions 0 assignees View on GitHub
enhancement Team:Fleet - DEPRECATED
Dominant language
TypeScript
Stars
21.3k
Forks
8.6k
PR merge metrics
PR metrics pending

Description

## Summary

When a Windows agent is enrolled via the Fleet UI using the MSI install command, the Fleet uninstall flow only surfaces `elastic-agent.exe uninstall`. For MSI-installed agents, the correct uninstall method is `msiexec /x` — using the `.exe` path leaves a stale Windows Installer database entry (MSI product record in the registry), causing the next MSI run to show "Change/Repair/Remove" instead of a fresh install prompt.

## Current behaviour

Fleet shows:

```
C:\"Program Files"\Elastic\Agent\elastic-agent.exe uninstall --uninstall-token
```

This is correct for agents enrolled via other methods. For MSI-installed agents, running this command removes agent files and services but does not remove the Windows Installer product record. The next time the user runs the MSI, it detects the stale record and presents a Change/Repair/Remove prompt instead of a fresh install.

## Expected behaviour

For agents installed via the MSI path, Fleet should surface:

```powershell
# Without tamper protection
msiexec /x elastic-agent--windows-x86_64.msi /qn /norestart

# With tamper protection enabled
msiexec /x elastic-agent--windows-x86_64.msi INSTALLARGS="--uninstall-token=" /qn /norestart
```

## Acceptance criteria

One of:
1. Fleet detects that the agent was enrolled via MSI and shows the `msiexec /x` uninstall command (instead of or alongside the `.exe` command)
2. Fleet's Windows uninstall instructions include a note: "If you installed via MSI, use `msiexec /x` instead — see [MSI install page link]"

At minimum, the uninstall guidance should not imply that `elastic-agent.exe uninstall` is the only Windows uninstall path when the user enrolled via MSI.

## References

- elastic-stack-installers MSI uninstall documentation: https://github.com/elastic/elastic-stack-installers
- Docs gap: elastic/docs-content#7927

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Fleet UI uninstall flow and the Windows agent enrollment path to determine how MSI installation is identified. Compare the existing elastic-agent.exe guidance with the MSI uninstall documentation and verify that the resulting instructions cover both MSI and non-MSI agents, including tamper protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.