Recover an accidentally deleted endpoint

The fix in one step

1. 1Generate a fresh enrollment token on the Enrollment page. Single-use is fine, since the agent only needs to redeem it once
2. 2On the affected machine, re-run the PowerShell installer with -Upgrade and the fresh token
3. 3Within about 30 seconds the endpoint reappears on the dashboard with a new endpoint id. History from the old endpoint stays in the deleted row; new events flow under the new id

The -LocalMsi flag avoids re-downloading the MSI from the dashboard and assumes PermitUSB.msi is sitting next to the script, which fleet-deploy packaging usually does anyway. Drop it if you want the script to pull the latest MSI by token instead.

What that command does under the hood

It looks like a normal in-place upgrade, but combining -Upgrade with -TenantToken is the explicit signal that you want to re-enroll. The script:

1. 1Stops the agent service and the tray, the standard upgrade preliminaries
2. 2Deletes credentials.bin, which is what forces the agent onto the first-run enrollment path instead of refreshing a token tied to the deleted endpoint id
3. 3Patches agent.json so its EnrollmentToken field carries the fresh token, since that field is cleared after every successful enrollment
4. 4Runs msiexec as a major upgrade. The MSI rewrites the bootstrap registry with the fresh token too, as a belt-and-braces fallback
5. 5Starts the service. The agent sees no credentials.bin, reads agent.json, enrolls with the fresh token, persists new credentials, and starts polling

If the agent is on 1.0.25.0 or newer

From 1.0.25.0 the agent has its own self-recovery path. When a refresh comes back endpoint_not_found, it peeks at the bootstrap registry’s current EnrollmentToken, and if that value is one it has not already redeemed, it re-enrolls with it instead of staying stuck. So even an installer push that does not take the script-side re-enrollment path, such as someone running msiexec directly with a fresh TENANT_TOKEN, recovers cleanly.

The script-side re-enrollment still works on older agents, 1.0.24 and below, because it does not depend on the agent doing anything clever. The script does the credential reset itself.

If the machine is fully unreachable

With no remote-exec channel at all, no RDP, no deployment tooling, no PSRemoting, there is no way to push the recovery from afar: the agent cannot reach the dashboard to be told to re-enroll, and the dashboard has no outbound channel to the agent. The only path is physical access. Run the same upgrade command locally, or fall back to the reset flow and reinstall fresh.

What to do with the deleted row

It stays in the database in a soft-deleted state. We do not surface its history on the endpoints list, but the events it generated before deletion remain attached to that row in the underlying store. After the agent re-enrolls it appears as a new endpoint with a new id: the old id and the new id refer to the same physical machine, but they are independent rows from the dashboard’s perspective.