symantec endpoint protection removal tool mac

This call to Apple’s uninstall API must be from the same code-signed app which is using the system extension. An example of this can be found in the code of the open source Santa tool created by Google:įor Santa, this functionality can be triggered from the command line by running the following command: The first is that the app developer must have written into their code signed app a way to trigger Apple’s uninstall API for system extensions. There are two parts to being able to silently uninstall a system extension.

For more details, please see below the jump. However, there is a way to bypass the admin authorization. In the latter case, removing authorization will also unload the system extension. In the past, Mac admins have dealt with this issue through user education, providing warnings like the one shown below, or (in macOS 11.3 and later) removing the profile which authorized the system extension. However, the RemovableSystemExtensions property is new in macOS Monterey and does not apply to macOS Big Sur and earlier. This is used to identify system extensions which can be deactivated without requiring admin authorization.

Be willing to enter admin credentials when prompted.įor macOS Monterey, this issue has been addressed by the addition of the RemovableSystemExtensions property to the -extension-policy profile payload.

Understand what the dialog is telling them.

This can be a problem for admins because it requires the logged-in user to:

As part of the move from using kernel extensions to system extensions, there is an issue which can be a problem for Mac admins: Uninstalling a system extension from the command line usually involves a GUI window popping up and requesting admin authorization.

Symantec endpoint protection removal tool mac