Deployment

Deployment Cleanup & Uninstall

Remove InputGuard from a device or clean up deployment settings before reinstalling or troubleshooting.

When to use cleanup

Cleanup removes InputGuard-specific deployment settings from a device so you can reinstall cleanly or troubleshoot a deployment. It is safe to run on a device that is being redeployed, decommissioned, or moved between deployment profiles.

Cleanup is not a full uninstall on its own

The cleanup script removes managed configuration and local deployment files. For a complete uninstall you also need to remove or unassign the InputGuard extension from Chrome, your MDM, or Google Admin — otherwise a force-installed extension can return on the next policy refresh.

Cleanup script downloads

Download the cleanup script for the device’s operating system and run it with administrator privileges. The script is safe to rerun and only touches InputGuard-specific entries.

Windows and Linux cleanup scripts

Cleanup scripts for Windows and Linux are coming soon. In the meantime, remove the InputGuard managed policy registry keys (Windows) or managed policy JSON files (Linux) that the deployment package wrote, then unassign the extension from your management tooling. See Managed policy JSON for where those settings live.

macOS cleanup

The macOS cleanup script removes InputGuard-specific Chrome managed policy entries, managed extension configuration, and local deployment device files. It preserves unrelated Chrome policies and does not delete Chrome profile data.

1
Download and run the script
Run the macOS cleanup script above with sudo. It backs up affected files before changing anything and only removes InputGuard-specific entries.
2
Remove the extension assignment
Remove or unassign the InputGuard extension from Chrome, your MDM, or Google Admin so a force-installed extension does not return.
3
Reload Chrome policies
Fully quit Chrome, reopen it, and reload chrome://policy — or restart the device — so the removed managed policy is no longer applied.

Full uninstall

For a full uninstall, first remove or unassign the InputGuard extension from Chrome, MDM, or Google Admin. Then run this cleanup script and reload Chrome policies or restart the device. Browser-managed deployments may return until the deployment assignment is removed.

Windows cleanup

A dedicated Windows cleanup script is coming soon. Until then, remove the InputGuard deployment settings manually:

Delete the InputGuard managed policy registry keys under HKLM\Software\Policies\Google\Chrome\3rdparty\extensions that the deployment package wrote.
Remove the InputGuard entry from the Chrome ExtensionSettings force-install policy.
Delete the local deployment device file under %ProgramData%\InputGuard.
Reload chrome://policy or restart the device to apply the changes.

Linux cleanup

A dedicated Linux cleanup script is coming soon. Until then, remove the InputGuard deployment settings manually:

Remove the InputGuard managed policy JSON files under /etc/opt/chrome/policies/managed and /etc/chromium/policies/managed.
Delete the local deployment device file under /var/lib/inputguard.
Reload chrome://policy or restart Chrome/Chromium to apply the changes.

Troubleshooting & reinstall

If InputGuard still appears managed after cleanup, the deployment assignment is usually still in place. Work through these checks:

Confirm the extension is no longer force-installed from your MDM, Google Admin, or browser policy — a force-install assignment reinstalls the extension on the next policy refresh.
Fully quit Chrome and reload chrome://policy, or restart the device, so cached managed policy is cleared.
Re-run the cleanup script after removing the assignment — it is safe to run more than once.
To redeploy clean, run cleanup first, then deploy the device again from its deployment profile in the portal.

Need to redeploy?

After cleanup, download a fresh deployment package from your deployment profile and deploy it to the device. See Deploy InputGuard to devices.