Rolling back and offboarding
Reversing everything, what deliberately stays behind and what to do when someone leaves the organisation.
Rolling back
Everything in this guide can be reversed.
Withdraw the forced installation
Remove the assignment of the configuration profile from step 2. The extension disappears from the browser at the next policy refresh. At the same time, remove any optional policies you set: MandatoryExtensionsForInPrivateNavigation, CloudAPAuthEnabled and IncognitoModeAvailability.
Clean up the sign-in policy
In this order:
- Remove the assignment of the sign-in script; otherwise a later edit will write the keys again.
- Assign the cleanup script from the console, with the same settings as the sign-in script (logged on credentials: No).
- Use the registry commands from step 1 to check that the keys are gone, then remove the cleanup script as well.
The cleanup script removes exactly what the sign-in script wrote, per user and only for the profiles loaded at that moment, and it is safe to run more than once. A hint left behind for a user who was not signed in is harmless.
Cleanup script in the rollout consoleIn step 1, under Rolling back.Remove the desktop app
On the Win32 app, add an assignment under Uninstall for the target group and remove the Required assignment. Removing the Required assignment on its own uninstalls nothing: the app stays on the devices.
Uninstalling deliberately leaves behind the data folder in each user profile (sign-in tokens and settings), the shared model cache and two registry keys per user.
| What stays behind | Where |
|---|---|
| Data folder per user | %LOCALAPPDATA%\beesensible-desktop |
| Old data folder (older versions) | %APPDATA%\beesensible-desktop |
| Model cache, machine-wide | C:\ProgramData\BeeSensible\engine-cache |
| Sign-in hint (the cleanup script removes it) | HKCU\Software\Policies\BeeSensible |
| Protocol registration of the app | HKCU\Software\Classes\beesensible |
To hand a device back clean, run this block in the system context (for example as a platform script) to remove the folders:
Get-ChildItem C:\Users -Directory | ForEach-Object {
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $_.FullName "AppData\Local\beesensible-desktop")
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $_.FullName "AppData\Roaming\beesensible-desktop")
}
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "C:\ProgramData\BeeSensible\engine-cache"
The protocol registration has to be removed per user, in that user's session:
reg delete "HKCU\Software\Classes\beesensible" /f
When someone leaves
Blocking or deleting an employee in Entra does not end their BeeSensible session straight away: the current session remains valid until it expires. So end their access in BeeSensible too. On the Members page of the dashboard, choose Actions → Sign out everywhere, then Remove member. If your organisation uses SCIM provisioning from Entra, the directory passes the block on automatically; BeeSensible sets up SCIM for you on request.
