Uninstall protection

Uninstall protection protects the Cloudflare One Client (formerly WARP) on Windows against unauthorized modification or uninstallation. When it is on, users must provide an administrator-generated code to uninstall the client. Without a valid code, the uninstall is blocked.

When uninstall protection is on, the Cloudflare One Client blocks the following actions until a valid code is entered:

• Uninstalling the client from Settings > Apps, Control Panel, or msiexec.
• Upgrading or downgrading the client with the .msi installer.
• Logging out of your Zero Trust organization from the client UI.
• Deleting the device registration with warp-cli registration delete.

On Windows 10 version 21H2 (build 19044) and later, the client also installs a file system driver. The driver blocks changes to client files in C:\Program Files\Cloudflare and C:\ProgramData\Cloudflare. It also blocks changes to the client's registry keys and services. The driver keeps enforcing these protections when the Cloudflare One Client service is stopped.

The driver also blocks changes to MDM files, such as C:\ProgramData\Cloudflare\mdm.xml. To change an MDM file on a protected device, unlock the client first.

Cloudflare provides two types of codes. Both types expire after a duration you choose, from 1 to 24 hours.

Device-specific uninstall codes follow fixed one-hour blocks aligned to UTC hours. The duration starts at the beginning of the UTC hour in which you generate the code. For example, a one-hour code generated at 10:45 UTC expires at 11:00 UTC.

The Cloudflare One Client verifies both types of codes locally. The device does not need an Internet connection to accept a code.

When the client accepts a code, it turns off uninstall protection until the code expires, plus one hour. The extra hour lets a slow upgrade or uninstall finish. Uninstall protection turns back on automatically after this period.

Uninstall protection is a device profile setting. It is off by default. Changes to this setting are recorded in your audit logs.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy/$POLICY_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"uninstall_protection": true
	}'

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"uninstall_protection": true
	}'

It may take up to 10 minutes for newly updated settings to propagate to devices.

The device must receive the updated profile before uninstall protection takes effect. After that, uninstall protection stays on when the device is offline.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/override_codes" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"type": "uninstall_protection",
		"scope": "device",
		"device_id": "$DEVICE_ID",
		"duration_hours": 4
	}'

{
	"result": {
		"code": "1234567"
	},
	"success": true,
	"errors": [],
	"messages": []
}

A device-specific uninstall code only works on the device it was generated for.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/override_codes" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"type": "uninstall_protection",
		"scope": "account",
		"duration_hours": 4
	}'

To uninstall the Cloudflare One Client on a protected device:

1. Get a device-specific uninstall code from your administrator.
2. Start the uninstall. For example, go to Settings > Apps > Installed apps and uninstall the Cloudflare One Client.
3. When the installer prompts you, enter the device-specific uninstall code and select Continue.
4. If Windows asks for administrator approval, approve the request.

The uninstall continues after the client accepts the code. If you select Cancel, the uninstall stops and the client stays installed.

If the code is wrong or expired, the installer shows an error and you can enter the code again. After repeated wrong codes, the client makes you wait before you try again. The wait increases with each wrong code, up to one minute.

Silent uninstalls require an account-wide uninstall token. Pass the token to the installer in the UNINSTALL_TOKEN property:

msiexec /x "<LOCAL_PACKAGE_PATH>" /qn UNINSTALL_TOKEN="<ACCOUNT_WIDE_UNINSTALL_TOKEN>"

To find the .msi package path, refer to Uninstall the Cloudflare One Client.

If the token is missing or invalid, msiexec exits with error code 1603 and the client stays installed. You cannot use a device-specific uninstall code in a silent uninstall.

The installer treats any uninstall that runs as the SYSTEM account as silent. This includes Microsoft Intune and other MDM tools, even when you use the /qb option.

Upgrades and downgrades with the .msi installer also require a code:

• Manual upgrade or downgrade: The installer prompts for a device-specific uninstall code.
• Silent upgrade or downgrade: Pass an account-wide uninstall token in the UNINSTALL_TOKEN property.

msiexec /i "Cloudflare_WARP_<VERSION>.msi" /qn UNINSTALL_TOKEN="<ACCOUNT_WIDE_UNINSTALL_TOKEN>"

The following updates do not require a code:

• Updates delivered by client version assignments.
• Upgrades from a client version that does not support uninstall protection. Uninstall protection turns on after the upgrade completes.

A silent downgrade to a client version earlier than 2026.9.0.0 ignores the UNINSTALL_TOKEN property. The earlier installer does not pass the token to the installed client, so the downgrade fails.

To downgrade silently, unlock the client with the account-wide uninstall token first, then run the earlier installer:

warp-cli uninstall-protection unlock --account "<ACCOUNT_WIDE_UNINSTALL_TOKEN>"
msiexec /i "Cloudflare_WARP_<VERSION>.msi" /qn

Run both commands within the token's validity period. For more information, refer to Unlock the client with warp-cli.

Manual downgrades are not affected. The installer prompts for a device-specific uninstall code as usual.

You can turn off uninstall protection on a device with warp-cli. Use this before an action that does not go through the installer prompt, such as logging out of your Zero Trust organization.

To unlock with a device-specific uninstall code:

warp-cli uninstall-protection unlock --device <DEVICE_SPECIFIC_UNINSTALL_CODE>

To unlock with an account-wide uninstall token:

warp-cli uninstall-protection unlock --account <ACCOUNT_WIDE_UNINSTALL_TOKEN>

To check whether uninstall protection is on, and how long it stays off after an unlock:

warp-cli uninstall-protection show

Uninstall protection: disabled
Grace period remaining: 7140 seconds

If the Cloudflare One Client service is not running, warp-cli sends the code directly to the file system driver. Run warp-cli from an elevated command prompt in this case.

When uninstall protection is on, the client disables the Logout button.

This applies even when Allow device to leave organization is turned on. To log out, first unlock the client.

To turn off uninstall protection, turn off Device Management Protection in the device profile. If you use the API, set uninstall_protection to false.

Devices turn off uninstall protection after they receive the updated profile. Devices that are offline stay protected until they reconnect. To remove the client from an offline device, use an uninstall code.

Check the following:

• The code has not expired.
• A device-specific uninstall code was generated for this device. Codes do not work on other devices.
• The code was generated for the device's current ID. Run warp-cli registration show on the device and check that the Device ID value matches the ID of the device in Team & Resources > Devices.
• You entered a device-specific uninstall code in the installer prompt. The prompt does not accept account-wide uninstall tokens.

The installer writes lines that start with Uninstall authorization: to the Windows Installer log ↗︎. To create a log, add /l*v <PATH_TO_LOG_FILE> to your msiexec command.

Diagnostic logs include rejected codes and the actions that the file system driver blocked.