Separate question, is agent "self-destruct" on the roadmap or is there documentation on the intent not to have a self-destruct? Fleet is the only device agent we deploy that can't remove itself via the web UI.

Hi Shawn! While we don't have a built-in option in the web UI, we do provide a script that you can run via Fleet to remove fleetd: https://fleetdm.com/guides/how-to-uninstall-fleetd

I had no idea Fleet could run ad-hoc scripts now

We have some scripts that can enable script execution if that helps: https://github.com/fleetdm/fleet/tree/main/assets/scripts

I'm running those now for our current devices, but the ones I wanted to clean up are devices that we don't manage any more but are still phoning home to our Fleet server

Fleet would need to have the ability to run scripts in order to action against itself, so our options are somewhat limited without another method of control on the devices. You can rotate your enrollment secret to break the hosts' connection to the server?

Yeah, we will probably have to do that. I don't like leaving the software on those devices but unless Fleet updates itself to have the ability to run specifically the removal commands, Idk what else can be done.

What version of Orbit are you running when you see that error?

1.54.0 I believe

How long has Fleet been installed on the host? The plist should be written with the value set to false. Is it possible that your host enrolled before the feature was added? https://github.com/fleetdm/fleet/blob/main/orbit/CHANGELOG.md#1160-sep-6-2023

Not that device, no. It was enrolled within the last 6 months. Although I believe our initial install on all devices is 1.1.0 and then we just let it update itself.

@Shawn Maddock I'll budget some time this week to update that script to include a check for the variable first.