Skip to main content

Revoking a machine

Revoking cuts a single machine off. Its credential is deleted, its connection drops within about a second, and reconnection attempts are refused.

How to revoke

Two places in the console, both doing the same thing:

  • Machines → the machine → Summary tab → Security card → Revoke
  • Machines → the machine's card → toolbar → Revoke

You are asked to confirm.

What survives

The machine's record stays. Its labels, its history, and its availability data are all intact — it is simply marked as no longer enrolled.

This is deliberate. A decommissioned machine you revoked last month should still be something you can look at, and deleting the record would take the history with it.

When to revoke

  • The machine was lost or stolen. Revoking stops it reporting anything further.
  • You are decommissioning it. Revoke first, then uninstall the agent, so nothing reports from it in between.
  • You think its credential file was copied. Revoke, then re-enroll it to issue a fresh secret — see Re-enrolling.
  • You do not recognise it. Revoke first and investigate afterwards.

Bringing it back

Run the agent again with an API key set. It re-enrolls into the same record with a new secret. Nothing is lost.

If the machine still has its old credential file, delete it first — the agent only re-enrolls when it finds no credential.

Revoking a machine versus revoking a key

They do different things and are not substitutes:

Revoking a machineRevoking an API key
Stops that machine reportingYes, in about a secondNo
Stops new machines enrollingNoYes
Affects other machinesNoNo
ReversibleYes, re-enroll itNo, create a new key

If you want to stop everything, you have to revoke each machine. There is no single switch that disconnects a whole fleet.