Skip to content

Instantly share code, notes, and snippets.

@karstengresch
Forked from m4rcsch/WARNING.md
Last active February 6, 2020 16:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save karstengresch/8e35abda55bac85e901cfe4544cb91b4 to your computer and use it in GitHub Desktop.
Save karstengresch/8e35abda55bac85e901cfe4544cb91b4 to your computer and use it in GitHub Desktop.
Remove SentinelOne agent from Mac. Because honestly, it doesn't seem to do anything at all. Run as root, best is to do this from a recovery mode, single user mode with writeable filesystem, ...

USE AT OWN RISK

.

// list Agents: launchctl list | grep senti
//stopping sentinelone
launchctl stop com.sentinelone.agent
launchctl stop com.sentinelone.sentineld-helper
launchctl stop com.sentinelone.sentineld-updater
launchctl stop com.sentinelone.sentineld
launchctl stop com.sentinelone.sentineld-guard
launchctl stop com.salopensource.sal.runner
launchctl stop com.salopensource.sal.random.runner
launchctl stop com.googlecode.munki.logouthelper
launchctl stop com.googlecode.munki.managedsoftwareupdate-check
launchctl stop com.googlecode.munki.managedsoftwareupdate-manualcheck
launchctl stop com.googlecode.munki.authrestartd
launchctl stop com.googlecode.munki.appusaged
launchctl stop com.googlecode.munki.managedsoftwareupdate-install
launchctl remove com.salopensource.sal.runner
launchctl remove com.salopensource.sal.random.runner
launchctl remove com.googlecode.munki.logouthelper
launchctl remove com.googlecode.munki.managedsoftwareupdate-check
launchctl remove com.googlecode.munki.managedsoftwareupdate-manualcheck
launchctl remove com.googlecode.munki.authrestartd
launchctl remove com.googlecode.munki.appusaged
launchctl remove com.googlecode.munki.managedsoftwareupdate-install
//removing sentinelone
launchctl remove com.sentinelone.agent
launchctl remove com.sentinelone.sentineld-helper
launchctl remove com.sentinelone.sentineld-updater
launchctl remove com.sentinelone.sentineld
launchctl remove com.sentinelone.sentineld-guard
//removing package
sudo pkgutil --forget com.sentinelone.pkg.sentinel-agent
//removing directories
sudo rm -rfv /Library/Extensions/Sentinel.ke*
sudo rm -rfv /Library/LaunchAgents/com.sentinelone.agent.plist
sudo rm -rfv /Library/LaunchDaemons/com.sentinelone*
sudo rm -rfv /Library/Preferences/Logging/Subsystems/com.sentinelone*
sudo rm -rfv /Library/Sentinel
sudo rm -rfv /private/etc/asl/com.sentinelone.sentinel
sudo rm -rfv /usr/local/share/man/man1/sentinelctl.1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment