Uninstall and revoke a collector
How to retire a collector cleanly: uninstall the host software and revoke its credential so it cannot re-authenticate.
Overview
Retiring a collector is two separate actions: removing the software from the host, and revoking its credential in AssurIQ. Doing only the first leaves an authenticated, unmonitored credential outstanding; doing only the second leaves software and a stale local credential file on a host that may be repurposed.
Revoke the credential
- 1Open the collector recordFrom the site's Collectors panel, or the Audit view, select the collector to retire.
- 2RevokeChoose Revoke Collector. This immediately invalidates its credential; any further authentication attempt is rejected.
- 3Confirm stateThe collector's health state changes to Revoked and it stops appearing as an active source for new jobs.
Uninstall the host software
Remove the collector package for the host's form factor.
| Form factor | Uninstall |
|---|---|
| Windows | Programs and Features, or AssurIQCollectorSetup.exe /quiet /uninstall |
| Linux (systemd) | systemctl disable --now assuriq-collector then remove the install directory and unit file |
| Docker | docker rm -f assuriq-collector and remove the data volume |
Reusing or reimaging the host
If the host is being reimaged or repurposed rather than decommissioned entirely, revoke the collector credential before wiping the disk. A reimaged host that later needs a collector again should enroll fresh with a new token rather than restoring a backup that contains the old credential.
Re-enrollment after revocation
A revoked collector credential can never be reactivated. If the same site needs a collector again later, generate a new enrollment token and run the install/enroll flow again; this creates a fresh credential rather than restoring the old one.
- Install the collector on Windows (x64)Unattended install of the Windows service build with an enrollment token and control plane URL.
- Install the collector on Linux (x64, systemd)Install the systemd-managed collector service and enroll it from the command line.
- Run the collector in DockerCompose or run the collector container with host networking and a secret-backed enrollment token.
Impact on evidence and assurance
Once revoked, a collector's site stops receiving fresh automatic evidence from that source. Controls that depended solely on that evidence move toward EVIDENCE GAP over time rather than failing outright. Plan the retirement of the last collector at a site alongside a plan for how ongoing evidence will be produced, whether by another collector or a connector.
- AIQ-COL-005Collector revokedThe collector's credential has been deliberately invalidated and it can no longer authenticate to the control plane.