diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
index bba9d921310da..136f314aa415f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/metadata/support/unenroll.ts
@@ -18,7 +18,8 @@ export async function findAllUnenrolledAgentIds(
       page: pageNum,
       perPage: pageSize,
       showInactive: true,
-      kuery: 'fleet-agents.packages:endpoint AND fleet-agents.active:false',
+      kuery:
+        '(fleet-agents.packages : "endpoint" AND fleet-agents.active : false) OR (NOT fleet-agents.packages : "endpoint" AND fleet-agents.active : true)',
     };
   };