There are 3 ways to request a device to leave the network, although none of them are perfect in that they do not guarantee the result of having a device exit immediately, or to force it to stay out of the network in the future ("kicking out a device").

Here are some descriptions of the leave request methods with pros and cons.

1) Send ZDO Leave to ZR parent with ZED's EUI as target
-Pros: Will always succeed (if ZED is still in the child table of ZR and ZR is reachable) with response status, regardless of what ZED's polling rate is.
-Cons: If ZED isn't polling parent regularly, parent's NWK Leave command to child could time out before child gets it, and child gets erased anyway. When child polls next time, parent will tell him to leave and rejoin because it's an non-child end device, so that gets you back to before the ZDO Leave.

2) Send ZDO Leave to ZED with ZED's EUI (or all-zero EUI) as target
-Pros: ZDO response clearly indicates whether ZED received the leave request. No confusion as above with ZED accidentally being told to rejoin.
-Cons: If ZED isn't polling parent regularly, it won't receive this request, so sender needs to be careful about timing of sending the request. In older EmberZNet stack versions (4.6 through 5.4), a bug existed that would sometimes reject a ZDO Leave Request sent to an end device depending on who was the sender. In EmberZNet versions 5.6.0 and earlier, the ZED won't get a ZDO Leave Response out before it leaves the network, so the requester must rely on the APS ACK rather than the ZDO response to confirm receipt.

3) Send APS Remove Device command (emberSendRemoveDevice) to ZR parent with ZED's EUI as deviceToRemove.
-Pros: APS-authenticated (unlike ZDO messages), so devices (even SE devices) can't choose to ignore this, and it is harder to spoof because it requires APS encryption.
-Cons: Need long address of child and parent for the command. No APS ACK available for APS commands, so can't confirm receipt by the parent. Still may encounter problem where parent deletes child before the child knows it was removed, causing child to rejoin on next poll attempt. Can only be sent by Trust Center.

In general, we recommend a fallback system, such as trying 2 and falling back to 1 (or 3) if it doesn't work.