Complete Guide: Fully Removing SentinelOne When You No Longer Have Console Access

When an organization transitions away from SentinelOne—especially during a provider or staffing change—it’s common to lose access to the management console before every endpoint has been properly offboarded. Once console access is gone, the normal offboarding workflow breaks, leaving many machines with:

• Locked Safe Boot settings
• Protected services that refuse to uninstall
• Ghost entries stuck in Windows Settings
• Components that block installation of a new antivirus
• Failed uninstalls that don’t appear in Control Panel but still linger in the registry

This guide walks you through a complete, field-tested removal process for SentinelOne on Server 2022 and Windows 10/11, including difficult cases such as Safe Boot Protection, VMs that won’t present Startup Settings, and devices where SentinelOne still appears under Apps even after cleanup.

These instructions are based on real-world offboarding scenarios where console access was lost mid-transition, requiring a full local removal path.

Download the SentinelOne Cleaner

Download the SentinelOneInstaller_windows_x64.exe uninstaller/cleaner and place it somewhere easy to access. You should be able to get this from SentinelOne support or your reseller, such as ConnectWise.

Boot the Device into Safe Mode

Because SentinelOne hardens itself against tampering, Safe Mode is required for a full removal.

Option A — Using msconfig

1. Press Win + R → type msconfig → press Enter
2. Go to Boot
3. Check Safe boot → Minimal
4. Click OK
5. Restart

If you get Access Denied, skip to Option B.

Option B — Safe Boot Protection Is Blocking You

If SentinelOne Safe Boot Protection is enabled, msconfig/bcdedit cannot modify boot settings.

You can still force Safe Mode by:

1. Causing the system to fail to boot 3–4 times
2. This brings up Startup Repair
3. Navigate to:
   Troubleshoot → Advanced Options → Startup Settings → Restart
4. Press 4 for Safe Mode

This works on Server 2022, Windows 10, and Windows 11.

If you are working inside a VM

Some VMs (especially those using VMware Paravirtual SCSI) won’t show Startup Settings at all since the WinPE environment cannot detect the disk due to missing drivers.

Fix: Temporarily switch the VM’s storage controller.

1. Power off the VM
2. Change disk controller from VMware Paravirtual → LSI Logic SAS
3. Boot and repeat the Safe Mode steps
4. After cleanup, revert the controller

3. Run the SentinelOne Cleaner in Safe Mode

1. Open File Explorer
2. Navigate to where you stored the cleaner
3. Shift + Right-click → “Open PowerShell window here”
4. Run:

.\SentinelOneInstaller_windows_x64.exe -c -t "1"

.\SentinelOneInstaller_windows_x64.exe -c -t "1"

If you get an error about Windows Installer not running:

Enable MSIServer for Safe Mode:

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"

Then run the cleaner again.

A new window will pop up as it begins removing SentinelOne components. When complete, it will prompt for a reboot.

4. Return the System to Normal Boot

If you used msconfig, remember to:

1. Reopen msconfig
2. Uncheck Safe boot
3. Restart normally

If you changed VM SCSI type, revert it now.

If SentinelOne Still Appears Under Settings → Apps

Sometimes SentinelOne is removed but the Windows Settings UI still shows it. This can also block installation of new AV products like BitDefender or Defender ATP onboarding.

Remove orphaned uninstall entries using this PowerShell script:

$keys = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($base in $keys) {
  Get-ChildItem $base | ForEach-Object {
    $dn = (Get-ItemProperty $_.PsPath -ErrorAction SilentlyContinue).DisplayName
    if ($dn -match "SentinelOne" -or $dn -match "Sentinel Agent") {
      Write-Host "Removing orphaned uninstall key: $dn" -ForegroundColor Yellow
      Remove-Item $_.PsPath -Recurse -Force
    }
  }
}

$keys = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
)

foreach ($base in $keys) {
  Get-ChildItem $base | ForEach-Object {
    $dn = (Get-ItemProperty $_.PsPath -ErrorAction SilentlyContinue).DisplayName
    if ($dn -match "SentinelOne" -or $dn -match "Sentinel Agent") {
      Write-Host "Removing orphaned uninstall key: $dn" -ForegroundColor Yellow
      Remove-Item $_.PsPath -Recurse -Force
    }
  }
}

After running this, refresh the Apps list—SentinelOne should no longer appear.

Conclusion

When console access is lost during a provider transition, removing SentinelOne can become unexpectedly challenging. Between Safe Boot Protection, blocked uninstallers, VM quirks, and orphaned registry entries, a clean removal requires a structured, manual process.

Using the steps above, you can fully offboard SentinelOne from any Windows environment—even when you no longer have an active SentinelOne management console to disable tamper protection or push an official uninstall.