Sentinelctl.exe Unload Site
To unload only for the current session (useful for troubleshooting):
sentinelctl unload --no-reload -t "your_site_token"
Cause: An application (e.g., solidworks.exe, arcmap.exe) is actively holding a license.
Solution: Close all applications that use Sentinel licensing. Use sentinelctl status -v to see active sessions.
In the high-stakes world of cybersecurity, endpoint protection platforms (EPP) like SentinelOne are designed to be "unbreakable." They embed deep hooks into the operating system, resist tampering, and often require complex procedures to disable, even temporarily. For IT administrators, security engineers, and malware analysts, knowing how to control this protection is as crucial as knowing how to deploy it.
One of the most powerful—and potentially dangerous—commands in the SentinelOne administrator’s arsenal is sentinelctl.exe unload.
This article provides a comprehensive, technical deep dive into what this command does, when to use it, how to execute it safely, and the potential pitfalls that await the unwary.
Contrary to a simple "stop" command, unload completely removes the SentinelOne kernel extensions (on macOS/Linux) or kernel drivers (on Windows) from the operating system. It effectively makes the agent blind and passive until the next reboot or a manual load command is issued.
When you run sentinelctl unload, the following components are typically removed from active memory:
Critical distinction:
| Command | Effect |
|---------|--------|
| sentinelctl disable | Disables policy enforcement but the kernel modules remain loaded (passive monitoring). |
| sentinelctl unload | Unloads kernel modules entirely. Agent shows as "Not Active" or "Offline." |
| sentinelctl load | Reloads the unloaded kernel components without rebooting. |
After completing your maintenance or troubleshooting, reload the kernel components:
sentinelctl load -t "your_site_token"
Confirm with sentinelctl status and then re-enable Tamper Protection immediately via the console.
To conclude, treat sentinelctl.exe unload as a surgical diagnostic tool, not a daily administrative task.
| Do | Don't |
| :--- | :--- |
| Use unload when the ACC shows stale sessions | Use unload during business hours without warning |
| Combine unload with a sentinelctl status pre-check | Assume unload will fix corrupted license files |
| Document each unload in your change management log | Rely on unload to fix broken hardware keys |
When in doubt, remember the hierarchy: Stop < Unload < Disable. And when all else fails, a full system reboot remains the universal reset button—though less elegant than the precise sentinelctl.exe unload. Sentinelctl.exe Unload
Last reviewed: October 2025. Compatible with Sentinel RMS version 8.5+ and Thales Sentinel LDK. For specific vendor applications, consult your software vendor’s licensing addendum before executing unload commands.
Mastering the SentinelOne CLI: When and How to Use "sentinelctl.exe unload"
If you're managing SentinelOne in an enterprise environment, you've likely encountered a situation where the agent's robust self-protection is a bit too effective. Whether you're troubleshooting a performance hit, performing a manual upgrade, or managing Volume Shadow Service (VSS) storage, the sentinelctl.exe unload command is a vital tool in your belt.
In this guide, we’ll break down what this command does, the prerequisites you need to run it safely, and the exact steps to execute it. What is Sentinelctl.exe?
The sentinelctl.exe utility is the primary command-line interface (CLI) for the SentinelOne agent on Windows. It allows administrators to perform local actions that are otherwise protected by the agent's tamper-proof security layers. Common uses include updating policies, enabling/disabling protection, and "unloading" the agent services entirely. The Role of the "Unload" Command
Running sentinelctl.exe unload stops the agent's active monitoring services and drivers. Unlike a standard "Stop Service" command in Windows, this bypasses the agent's self-protection mechanisms (provided you have the right credentials). Common Use Cases:
VSS Management: Clearing or resizing shadow storage when SentinelOne is blocking access.
Deep Troubleshooting: Determining if the agent is conflicting with a legacy application.
Manual Uninstalls/Upgrades: When the cloud console cannot reach the endpoint. Prerequisites Before you start typing, ensure you have:
Administrative Rights: You must run the Command Prompt as an Administrator.
The Agent Passphrase: This is the most critical piece. You cannot unload the agent without the unique passphrase generated by your SentinelOne Management Console.
Where to find it: Go to the Sentinels tab, select the machine, and click Actions > Agent Actions > Show Passphrase. Step-by-Step Guide to Unloading the Agent 1. Open an Administrative Command Prompt To unload only for the current session (useful
Navigate to the SentinelOne installation directory. This path typically includes a version-specific folder:
cd "C:\Program Files\SentinelOne\Sentinel Agent Use code with caution. Copied to clipboard
Tip: You can use cd "C:\Program Files\SentinelOne\Sentinel Agent *\" to jump straight in without knowing the exact version number. 2. Disable Self-Protection
Even with the command, the agent will fight back unless you "unprotect" it first using your passphrase: sentinelctl.exe unprotect -k "YOUR_PASSPHRASE" Use code with caution. Copied to clipboard 3. Execute the Unload Command
To unload the agent services (often including the -slam flag for a full unload of all components), run: sentinelctl.exe unload -slam -k "YOUR_PASSPHRASE" Use code with caution. Copied to clipboard
Once this completes, the agent's "purple icon" in the system tray will typically disappear or turn gray, indicating it is no longer active. How to Restart the Agent (Load)
Never leave an endpoint unprotected for longer than necessary. Once your maintenance is finished, you must "load" and "protect" the agent again to restore security. Reload the services: sentinelctl.exe load -slam Use code with caution. Copied to clipboard Re-enable self-protection: sentinelctl.exe protect Use code with caution. Copied to clipboard Summary Table: Quick Commands Unprotect sentinelctl.exe unprotect -k "passphrase" Unload sentinelctl.exe unload -slam -k "passphrase" Load sentinelctl.exe load -slam Protect sentinelctl.exe protect
For more detailed technical documentation or help with VSS errors specifically, refer to official resources like the SonicWall Knowledge Base or the SentinelOne Success Portal.
Do you need the specific commands for macOS or a guide on troubleshooting VSS shadow storage issues?
Follow-up: Would you like the steps for resolving SentinelOne-specific VSS errors? SentinelOne agent command line tool - SonicWall
To "unload" the SentinelOne agent using sentinelctl.exe , you are essentially putting the security software into a dormant state without fully uninstalling it. This is typically done for troubleshooting, such as resolving software conflicts or clearing stuck shadow copies. Here is the "story" or process for executing the 1. Retrieve the Passphrase
Because SentinelOne has built-in anti-tamper protection, you cannot simply stop its services. You must have a unique Passphrase (also called an Uninstall Token): Log into your SentinelOne Management Console (or Endpoints) tab and select the specific device. and select Show Passphrase . Copy this key. 2. Locate sentinelctl.exe Cause: An application (e
The tool is usually located in a version-specific folder within the SentinelOne installation directory:
C:\Program Files\SentinelOne\Sentinel Agent
Once the command is entered, the SentinelOne icon in the system tray should disappear or turn gray, and the services (like SentinelAgent.exe
) will stop running. You can now perform maintenance tasks, such as deleting shadow copies or troubleshooting performance issues. 5. Re-loading the Agent
To bring the protection back online without a reboot, use the sentinelctl.exe load -a Use code with caution. Copied to clipboard
The command sentinelctl.exe unload is used to stop or "unload" the SentinelOne agent services on a Windows machine. It is typically used for maintenance, troubleshooting, or when certain system operations (like resizing shadow storage) are being blocked by the agent's protection. Command Syntax
In most recent versions, this command requires an anti-tamper passphrase (the "k" switch) to execute. The standard sequence for disabling the agent is:
Navigate to the Agent directory:cd /d "C:\Program Files\SentinelOne\Sentinel Agent
Unprotect the agent:sentinelctl.exe unprotect -k "your_passphrase"
Unload the agent:sentinelctl.exe unload -k "your_passphrase" Key Parameters
-k "passphrase": Used to provide the unique agent passphrase found in the SentinelOne Management Console.
-slam: Often used in conjunction with unload to stop the SentinelOne Service Control Manager. Related Commands
sentinelctl.exe load: Restarts the agent services after they have been unloaded.
sentinelctl.exe protect: Re-enables the anti-tamper protections once the agent is running. Move Shadow Storage from One Volume to Another