This device was removed from your organization AgenShield is not protecting this Mac. Enter an enrollment token from your administrator to start again.This is not an error and not a crash. This Mac’s registration with your organization ended, and AgenShield responded by standing down. That normally means an administrator removed it in the Frontegg Portal. It can also mean this Mac was enrolled again from scratch — enrolling replaces the previous registration, and the older one stops working.
What state the Mac is in
AgenShield is still installed, but it is not protecting anything:
This is deliberate, and it is the safe direction. When a device loses its
management relationship, the alternative would be to keep applying whichever
policy happened to be in place at the time — a policy that can never be
corrected again. Instead AgenShield gets out of the way entirely.
Nothing on the Mac is blocked, quarantined, or removed. Every AI coding agent
installed on it continues to work exactly as it did before AgenShield was
installed.
How soon it takes effect
Removing a device is not instant. The Mac finds out the next time it checks in with your organization, so expect a few minutes between removing it and seeing it stand down — and longer if the Mac is asleep or offline, in which case it stands down on its next connection. Until it stands down, the Mac keeps applying the policy it last received. It cannot receive a new one.Versions before 2026.8.4 could take considerably longer — up to about half an
hour — to notice. If you are waiting on a removal, check the version first.
How to confirm it
Open the AgenShield dashboard. If the device was removed, you will see the message above instead of the usual overview, with a field for an enrollment token. The menubar icon shows the attention state, and its panel carries the same message and field. If you see something different — a sign-in prompt, or a report that enforcement is paused — this page is not your situation. See Enforcement Paused instead.How to start protecting this Mac again
You need a valid enrollment token from whoever administers AgenShield for your organization.1
Ask your administrator for an enrollment token
They generate it in the Frontegg Portal. It is a single long string of
letters and numbers.
2
Enter it
Paste it into the field on the AgenShield dashboard, or into the menubar
panel — either works, and both do the same thing.
3
Wait for protection to come back
AgenShield registers the Mac, downloads your organization’s current policy,
and only then starts enforcing again. This usually takes a minute or two. You
do not need to restart anything, sign in, or reinstall.
If your organization uses a different AgenShield server than the default,
choose Use a different server on the dashboard and enter it alongside the
token. Most people will not need this — the address is remembered.
If it does not clear
- “Re-enrollment failed” — the token is most likely expired or already used. Ask your administrator for a fresh one.
- The message returns after a short time — the device may have been removed again, or removed from a different organization than the token belongs to. Check with your administrator which organization the token was issued for.
- The dashboard cannot reach AgenShield at all — that is a different problem; see Collecting diagnostics.