diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
index 136f314aa415f..ca2ced177ab33 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
@@ -19,7 +19,7 @@ export async function findAllUnenrolledAgentIds(
       perPage: pageSize,
       showInactive: true,
       kuery:
-        '(fleet-agents.packages : "endpoint" AND fleet-agents.active : false) OR (NOT fleet-agents.packages : "endpoint" AND fleet-agents.active : true)',
+        '(fleet-agents.active : false) OR (NOT fleet-agents.packages : "endpoint" AND fleet-agents.active : true)',
     };
   };