Skip to main content
Red Canary help

Manually Remove Network Quarantine (Isolation) from SentinelOne Endpoint

  • Updated .

Issue

How do I remove network quarantine (isolation) manually from an endpoint with the SentinelOne agent installed?

Environment

SentinelOne

Resolution

Run the following commands in an elevated command prompt:

For Windows:

sentinelctl unprotect -b -k "<passphrase>" 
sentinelctl unquarantine_net 
sentinelctl protect

For macOS:

sudo sentinelctl unprotect -k "<passphrase>"
sudo sentinelctl set allow-network
sudo sentinelctl protect

To identify the passphrase for a certain endpoint, go to the Sentinels page, search for the endpoint in question and select Actions > Agent Actions > Show Passphrase.