Rolling back and offboarding
Reversing everything, what deliberately stays behind, and what to do when someone leaves the organisation.
Rolling back
Everything in this work instruction is reversible.
Withdraw the forced install
Remove the assignment of the configuration profile from step 2. The extension disappears from the browser at the next policy refresh. In the same round, remove the optional policies you set: MandatoryExtensionsForInPrivateNavigation, CloudAPAuthEnabled and IncognitoModeAvailability.
Clean up the sign-in policy
In this order:
- Remove the assignment of the sign-in script, otherwise a later edit sets everything again.
- Assign the cleanup script from the console, with the same settings as the sign-in script (logged on credentials: No).
- Check with the registry commands from step 1 that the keys are gone, then remove the cleanup script as well.
The cleanup script removes exactly what the sign-in script wrote, per user, only for the profiles loaded at that moment, and can safely run more than once. A hint left behind for a user who was not signed in is harmless.
Cleanup script on the deployment consoleUnder step 1, at Rollback.Remove the desktop app
On the Win32 app, add an assignment under Uninstall for the target group and remove the Required assignment. Only removing the Required assignment removes nothing: the app then stays on the devices.
The uninstall deliberately leaves behind: the data folder per user profile (sign-in tokens and settings), the shared model cache, and two registry keys per user.
| What stays behind | Where |
|---|---|
| Data folder per user | %LOCALAPPDATA%\beesensible-desktop |
| Old data folder (older versions) | %APPDATA%\beesensible-desktop |
| Model cache, machine-wide | C:\ProgramData\BeeSensible\engine-cache |
| Sign-in hint (the cleanup script removes it) | HKCU\Software\Policies\BeeSensible |
| Protocol registration of the app | HKCU\Software\Classes\beesensible |
To hand a device back clean, run this cleanup block for the folders as system (for example as a platform script):
Get-ChildItem C:\Users -Directory | ForEach-Object {
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $_.FullName "AppData\Local\beesensible-desktop")
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue (Join-Path $_.FullName "AppData\Roaming\beesensible-desktop")
}
Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "C:\ProgramData\BeeSensible\engine-cache"
The protocol registration is removed per user, in a session of that user:
reg delete "HKCU\Software\Classes\beesensible" /f
When someone leaves
Blocking or deleting an employee in Entra does not end the BeeSensible session right away: the running session stays valid until it expires. So end the access in BeeSensible as well. On the members page of the dashboard: Actions → Sign out everywhere, then Remove member. If your organisation uses SCIM provisioning from Entra, the directory pushes the block through by itself; BeeSensible sets up SCIM for you on request.
