Skip to main content
A standard uninstall removes Velatir. This page is for when it does not β€” the device will not come off through your MDM, the uninstall was interrupted, or items remain once it has finished. The cleanup script below removes everything Velatir put on a Windows device, and is safe to run alongside or instead of msiexec /x. Start with the standard route in Download and install. Come here if it does not finish the job.
A full run removes Velatir completely β€” including a version you may want to keep. If the device is already running a current version and you only want to clear out what an older one left behind, use -LegacyOnly.

​
When you need it

​
Get the script

​
Run it on one device

Preview first β€” this changes nothing:
Then run it for real:
It asks for administrator rights if you start it without them. Every step is independent, so one failure never stops the rest, and you can run it again as many times as you need. Restart the device afterwards to finish clearing a removed network adapter. Internet access returns without a restart β€” the script repairs routes first, before the slower work, so a device that lost connectivity is usable again immediately.

​
Deploy it with Intune

1

Change the app assignment first

Set the Velatir app assignment to Uninstall, or remove it. While it is still assigned as Required, Intune reinstalls the app behind the cleanup and the device looks unchanged.
2

Add it as a remediation script

Go to Devices β†’ Scripts and remediations, add the script, and set it to run as SYSTEM in 64-bit PowerShell. A remediation script needs no detection rule, so a detection rule that never matches cannot block the removal.
3

Act on the exit code

0 means the device is clean. 2 means something remains β€” restart those devices and run it again. The device also writes a full transcript to %TEMP%\Velatir-uninstall-<timestamp>.log.
The same approach works for any MDM or RMM tool that can run PowerShell as SYSTEM.
Removing Velatir is not an upgrade path. If you want a device on a current version, uninstall and then install again β€” see Download and install.

​
Already running a newer version

If a device was updated to a current version before you ran the cleanup, an older version’s leftovers are stranded underneath a working install. Add -LegacyOnly:
This removes only what a current version cannot own, and checks each item is genuinely orphaned before touching it. It never runs msiexec, and never removes the service, the program directories, the registry keys, or the certificate your current install is using.

​
What it removes

  • The VelatirAgent service, the logon task older versions used, and any running Velatir processes
  • Network routes and the Velatir network adapter, plus the packet-capture driver older versions installed
  • Velatir firewall rules
  • Velatir certificates from the trusted root stores
  • C:\Program Files\Velatir, C:\ProgramData\Velatir, every user’s %LOCALAPPDATA%\Velatir, and the Start menu shortcut
  • Velatir registry keys, its entry in the machine PATH, and the NODE_EXTRA_CA_CERTS environment variable it set

​
What it leaves alone

The script only ever removes things it can confirm are Velatir’s:

​
Confirm the device is clean

The script prints a verification report and exits 2 if anything remains. To check by hand:
On macOS with Firefox, the Velatir browser extension may still be listed after uninstalling. It is inactive, and Firefox does not remove policy-installed extensions by itself. See Download and install for how to remove it.

​
Next steps

Download and install

Install a current version on a cleaned device.

Enterprise deployment

Roll out across your fleet with Intune, Jamf, or any MDM.

Troubleshooting

Resolve install and first-run issues.

FAQ

Common questions about the desktop app.