Hi! If I remove a device from fleet would all the deployed queries be removed from it? I understand osqueryd will still running but what about the deployed queries? Should I follow a different procedure if I want to remove all the content before removing the device from fleet? Thanks in advance!
g
Grant Bilstad
02/21/2024, 5:02 PM
Greetings @Rafa Bono,
Would probably start with removing fleetd or breaking connection to Fleet on the endpoint. If you remove the endpoint from Fleet, they will re-enroll and get the configured queries.