Skip to content

System Decommission

This procedure covers removing systems from a customer's Enclave organisation, whether temporarily or permanently. The key decision is whether to disable or delete the system.

Disable vs delete

Action Effect Reversible Licence impact
Disable System cannot connect but remains enrolled in the organisation. Its certificate is retained. Yes, re-enable at any time from the Portal. System continues to consume a licence seat.
Delete System's certificate is permanently revoked. It is removed from the organisation and can no longer connect. No. The system must be re-enrolled with a new enrolment key to regain connectivity. Licence seat is released.

A disabled system is still enrolled, so it still counts towards the customer's licensed seat total and you are still billed for it. If a system is not coming back, deleting it releases the seat. Note that licensed counts do not automatically decrease after a deletion; you need to use Amend Licence Count in the Partner Portal to reduce the count and stop being billed for the freed seat. See Billing - Amending seat counts.

When to disable

Disable a system when the removal is temporary and you expect the system to reconnect:

  • Device under investigation or quarantine
  • Employee on extended leave
  • Maintenance window where connectivity should be suspended
  • Testing a policy change in isolation

When to delete

Delete a system when the removal is permanent and the device will not return:

  • Device decommissioned, lost, or replaced
  • Employee offboarded
  • System compromised and certificates should be revoked
  • End of a contractor engagement

Decommissioning a single system

Disable

  1. In the Enclave Portal, navigate to the Systems page.
  2. Select the system and open its details pane.
  3. Toggle the system to Disabled.
  4. Confirm the system appears as disabled in the systems list.

Delete

  1. In the Enclave Portal, navigate to the Systems page.
  2. Select the system and choose Delete (or Revoke).
  3. Confirm the deletion. The system's certificate is permanently revoked.
  4. Uninstall the Enclave agent from the device:
    • Windows: enclave.exe uninstall or remove via Programs and Features
    • macOS: sudo brew uninstall enclave or remove the .pkg
    • Linux: use the package manager (apt remove enclave or yum remove enclave)
  5. If the system was enrolled using a single-purpose enrolment key, consider whether to disable or delete the key.

Bulk decommission

For decommissioning multiple systems (e.g. fleet refresh, customer offboarding), use the Enclave API to automate the process.

The Cleaning Up Inactive Systems tutorial provides a ready-made PowerShell script that queries all systems in an organisation and deletes those not seen for a configurable number of days. The script accepts:

  • -orgId the customer's organisation ID
  • -apiKey an API key with write access
  • -maxInactiveDays threshold for inactivity (default 90 days)
  • -test dry-run mode that lists systems without deleting them

Run in test mode first to review which systems would be removed:

.\cleanup.ps1 -orgId "YOUR_ORG_ID" -apiKey "YOUR_API_KEY" -maxInactiveDays 90 -test

Warning

Deleting a system permanently revokes its certificate. The system must be re-enrolled with a new enrolment key to restore connectivity. Always run in test mode first.

After decommission

  • Check enrolment keys. If the decommissioned systems were the only ones using a particular key, disable or delete that key.
  • Review policies. If a tag now has zero members, the policies referencing it will have no effect. Consider whether to leave the policy in place (for future use) or remove it.
  • Update documentation. Record the decommission in your PSA or documentation system, including the reason and date.
  • Verify licence counts. In the Partner Portal, confirm the customer's enrolled count has decreased. Licensed counts do not automatically decrease; use Amend Licence Count to reduce if appropriate. See Billing - Amending seat counts.

Last updated July 22, 2026