An agent a user can delete is a suggestion, not management. Endpoint Central can lock its agent down — uninstall demands a one-time code from the console — while keeping a clean, official exit for the admin. Both halves of that design are in this guide.
Every IT admin has seen it: the PC that quietly left management because its user removed the 'annoying office program'. ManageEngine's answer is the Agent Protection Settings in the Endpoint Central console: switch on the restriction and Control Panel uninstall demands a TOTP — a time-based one-time password that only an admin can read in the console, under Agent → Computers → View OTP. The same settings family can also restrict users from stopping the agent service. This guide turns the protection on, lists the removal routes that remain legitimate, and is honest about what this lock can and cannot stop.
This agent is protected by your administrator. Enter the one-time password (OTP) shown in the Endpoint Central console to continue with uninstallation.
OTP [ _ _ _ _ _ _ ] [ Continue ] [ Cancel ]
Log in to the Endpoint Central console as an administrator and open Agent → Agent Settings → Agent Protection Settings. There you can restrict users from uninstalling the agent (and the Distribution Server) and restrict them from stopping the agent service. Enable the restrictions for the offices you manage, and save. One timing fact from ManageEngine's own documentation: the restriction reaches agents during their refresh cycle (about 90 minutes), so a PC does not become protected the second you click — verify later the same day on one machine by opening its Control Panel uninstall entry and confirming the OTP prompt appears.
Protection is a lock with the key kept in the console, not a wall. To retire a PC properly, select it in Agent → Computers and use the console's Uninstall Agent action — the machine leaves the Scope of Management and the agent removes itself. If you are standing at the PC and uninstalling from the Control Panel manually, the prompt asks for the OTP: read the current code in the console via Agent → Computers → View OTP and enter it. Because the code is time-based, fetch it when you are ready to type it, not an hour earlier. This is the designed flow — quick for admins, closed for everyone else.
Some removals do not happen through any console: a PC from a decommissioned server, a remote-office machine being rebuilt, an agent whose server no longer exists. ManageEngine's documented manual route uses a script — download UnInstallDCAgent.vbs (supplied as a text file to rename), run it on the client from an elevated command prompt with CSCRIPT UnInstallDCAgent.vbs, and enter the OTP code during the process if protection was configured. The same script can be run as a startup script through GPO to clear many machines, or pushed with a tool like PsExec for a remote office. Keep the script and OTP handling inside IT — a removal tool that anyone can run defeats the protection you just enabled.
A corrupted agent can reach a state where it neither works nor uninstalls: service damaged, files half-present, the console unable to reach it. For exactly this, ManageEngine provides an Agent Cleanup Tool that strips the agent components from the machine so it returns to a clean slate. Use it as the last rung, not the first: cleanup removes the agent without the console's knowledge, so afterwards reinstall the correct office package promptly (or record that the PC is intentionally unmanaged) and confirm the machine's state in the Scope of Management. A PC left in limbo — agent gone, console still expecting it — will haunt your stale-agent reports.
Be clear-eyed about what this is. Agent protection stops the realistic threat: casual and curious uninstalls, cleanup utilities, and well-meaning users tidying 'unused programs'. It raises the bar exactly where office risk lives. It is not a defence against a determined person with local administrator rights, physical access and time — very little installed software is. That is fine: the goal is that no PC leaves management silently or accidentally, and that any removal is either done by IT or noticed by IT in the last-contact reports. Pair the lock with the weekly stale-agent check from the verification guide and the system is honest: machines may leave management, but never invisibly.
Uninstalling the agent is only half of retiring a PC. If the machine is scrapped, sold or given away, also remove it from the Scope of Management in the console so your managed count, licence usage and reports stop carrying a ghost. If the PC is being reimaged or moved between offices, uninstall first, then install the new office's fresh package and confirm the check-in under the right office. This small discipline — agent and record always removed together — is what keeps an Endpoint Central console trustworthy year after year instead of slowly filling with archaeology.
See the console route that puts the agent on the PC — the installation this protection is designed to keep intact.
▶️ Watch Full VideoNo — that is the Agent Protection Settings working as designed. Uninstallation is restricted, and the Control Panel asks for a one-time password that only an admin can read in the console under Agent, then Computers, then View OTP.
Prefer the console: select the computer in Agent, then Computers, and use Uninstall Agent. If you are uninstalling locally and hit the OTP prompt, fetch the current code from View OTP in the console and enter it. For a corrupted agent that will not uninstall, ManageEngine's Agent Cleanup Tool is the last resort.
Use the manual script route: run UnInstallDCAgent.vbs on the clients (CSCRIPT UnInstallDCAgent.vbs), entering the OTP if one was configured, or run it as a GPO startup script to clear many machines at once. It is advised to remove agents from the Scope of Management before uninstalling the product itself.