: SentinelOne uses VSS (Volume Shadow Copy Service) for rollback protection. If these snapshots are filling up disk space, administrators use sentinelctl.exe unload -a -H -s -m -k "[Key]" to take the agent offline and manually delete the shadow storage.
You are about to replace a failed USB hub on a license server. All network licenses are hosted on physical dongles. Sentinelctl.exe Unload
REM Script: Temp_Unload_Agent.bat REM Purpose: Unload SentinelOne, run a legacy tool, then reload. : SentinelOne uses VSS (Volume Shadow Copy Service)
After unloading, to reload the agent and resume protection: All network licenses are hosted on physical dongles
command, which temporarily stops the agent's protection and services. When to Use the Unload Command Administrators typically use sentinelctl.exe unload
REM Step 1: Log the action to a local file and Windows Event Log echo %DATE% %TIME% - Unloading SentinelOne for maintenance >> C:\Logs\sentinel_unload.log eventcreate /ID 9001 /L APPLICATION /T INFORMATION /SO "SentinelMgmt" /D "SentinelOne agent unload initiated"