Reset an endpoint

The MSI uninstall is intentionally non-destructive: it removes the binaries but leaves %ProgramData%\PermitUSB\ in place so a reinstall preserves event history across upgrades. That is the right default for production, and the wrong default when you want a fresh enrollment on a machine that previously ran PermitUSB.

OperationsTeardown

When you would want to reset

You decommissioned the endpoint server-side and want to re-enroll the same machine as a new endpoint
You are moving a test machine between workspaces or environments
The agent is stuck in a bad credential state after the dashboard purged the endpoint
You are prepping a machine to hand to a different team and want no PermitUSB residue

What persists after MSI uninstall

Location	Contents
C:\ProgramData\PermitUSB\	agent.json (endpoint id, server URL, group), credentials.bin (DPAPI-encrypted refresh token), events.db, policy.bin, agent.log, driver-install.log, crash-state.json, pause-marker.json, and an updates folder holding downloaded installers
HKLM\Software\PermitUSB\Bootstrap	Registry values written by the MSI from the TENANT_TOKEN, SERVER and ENDPOINT_GROUP properties. Re-read on first run if agent.json is missing

Three ways to reset

Path	When to use it
msiexec /x with PURGE_DATA=1	Unattended uninstall that should also wipe data. Safest in scripted deploys, CI and fleet teardown.
Reset-PermitUSB.ps1	Interactive reset on a workstation. Stops services and tray, optionally uninstalls the MSI, and surfaces what was cleaned.
Manual three-line cleanup	The script is not on hand and you want a one-off teardown.

Option 1: PURGE_DATA on uninstall

The MSI exposes a PURGE_DATA property. Set it to 1 on uninstall and the sequence deletes the data directory after stopping the service. The default is 0, so a normal uninstall keeps your event history and credentials.

msiexec /x PermitUSB.msi /qn PURGE_DATA=1

# Or by product code, preferred for fleet scripts because it survives version bumps
msiexec /x {GUID} /qn PURGE_DATA=1

Option 2: reset script

Reset-PermitUSB.ps1 stops the service and tray, optionally uninstalls the MSI, then wipes both locations above. Download it from the Agent releases page, copy it onto the target machine, and run it from an elevated PowerShell.

# Interactive, confirms before doing anything destructive
.\Reset-PermitUSB.ps1

# Unattended teardown including MSI uninstall
.\Reset-PermitUSB.ps1 -Uninstall -Force

# Fresh enrollment but keep historical events
.\Reset-PermitUSB.ps1 -KeepEvents -Force

# Keep events and the log file, handy when filing a bug report
.\Reset-PermitUSB.ps1 -KeepEvents -KeepLogs -Force

Flag	Effect
-Uninstall	Also run msiexec /x to remove the MSI itself. Without this, the binaries stay.
-KeepEvents	Preserve events.db. Useful when re-enrolling against a different workspace for testing.
-KeepLogs	Preserve agent.log. Useful for post-mortems.
-Force	Skip the confirmation prompt. Required for unattended use.

What happens after reset

With local state gone, the next install behaves like a first-time enrollment:

Generate a fresh enrollment token on the Enrollment page
Run the msiexec command shown there on the target machine
The MSI seeds the bootstrap registry, the agent enrolls with the new token, gets back a new endpoint id and credentials, writes them to the data directory, and starts polling

Option 3: manual cleanup

The same local state the script wipes, in three commands, run as Administrator:

Stop-Service -Name PermitUSB.Agent -ErrorAction SilentlyContinue
Remove-Item -Path 'C:\ProgramData\PermitUSB' -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path 'HKLM:\Software\PermitUSB' -Recurse -Force -ErrorAction SilentlyContinue

Something missing or wrong here? Tell us. Documentation gaps get filled fast.