Uninstall

1Kosmos Windows Workstation MFA Agent can be uninstalled using either the MSI or EXE method, depending on how it was originally installed. A reboot is required after uninstall to remove the machine.

---

Choosing the Right Uninstall Method

Use the method that matches how the agent was installed on the target machine.

If the agent was installed using	Use
The MSI package (1KosmosCredentialProvider.msi)	Uninstall MSI
The EXE installer (1KosmosInstaller.exe)	Uninstall EXE

Note: If you are unsure which installer was used, check Settings > Apps or Control Panel > Programs and Features for the entry name. Both methods produce the same uninstall result — the difference is only in the removal mechanism.

---

What Uninstall Removes

Item	Removed on Uninstall
Credential Provider binaries	Yes
Installation directory (C:\Program Files\1Kosmos\BlockIDCredentialProvider)	Yes
Registry entries for the Credential Provider	Yes
Log files (C:\Program Files\1Kosmos\1KosmosCredentialProvider\Logs)	Yes — directory is removed with the installation folder
Configuration applied via REGCONFIG.ini at install time	Yes — registry values written during install are removed
User enrollment data	No — enrollment data is stored in the 1Kosmos tenant, not on the workstation
AdminX journey configuration	No — journey and policy configuration in AdminX is unaffected

Note: Because enrollment and journey configuration are tenant-side, uninstalling the agent from a workstation does not affect other workstations or the user's enrolled MFA methods. Re-installing the agent on the same machine will restore MFA enforcement without requiring re-enrollment.

---

Before You Uninstall

• Confirm you have Local Administrator or Domain Administrator rights on the target machine.

• Ensure no users are actively logged in to the workstation.

• Plan for a reboot immediately after uninstall — the 1Kosmos tile will remain visible on the login screen until the machine is restarted.

• If uninstalling as part of a rollback or incident response, notify affected users that standard Windows authentication will be active after reboot.

Warning: Uninstalling the Credential Provider removes all 1Kosmos MFA enforcement from the workstation. Users will revert to standard Windows password authentication immediately after reboot. Ensure this is intentional and that any compliance or access control requirements are addressed before proceeding.