Skip to content

Instantly share code, notes, and snippets.

@m4rcsch
Forked from Ambroos/WARNING.md
Last active April 25, 2021 09:00
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save m4rcsch/f885c489263f79dd367daf9cecd8281e to your computer and use it in GitHub Desktop.
Save m4rcsch/f885c489263f79dd367daf9cecd8281e to your computer and use it in GitHub Desktop.
Remove SentinelOne agent from Mac. Because honestly, it doesn't seem to do anything at all. Run as root, best is to do this from a recovery mode, single user mode with writeable filesystem, ...

USE AT OWN RISK

This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.

// list Agents: launchctl list | grep senti
//stopping sentinelone
launchctl stop com.sentinelone.agent
launchctl stop com.sentinelone.sentineld-helper
launchctl stop com.sentinelone.sentineld-updater
launchctl stop com.sentinelone.sentineld
launchctl stop com.sentinelone.sentineld-guard
//removing sentinelone
launchctl remove com.sentinelone.agent
launchctl remove com.sentinelone.sentineld-helper
launchctl remove com.sentinelone.sentineld-updater
launchctl remove com.sentinelone.sentineld
launchctl remove com.sentinelone.sentineld-guard
//removing package
sudo pkgutil --forget com.sentinelone.pkg.sentinel-agent
//removing directories
sudo rm -rfv /Library/Extensions/Sentinel.ke*
sudo rm -rfv /Library/LaunchAgents/com.sentinelone.agent.plist
sudo rm -rfv /Library/LaunchDaemons/com.sentinelone*
sudo rm -rfv /Library/Preferences/Logging/Subsystems/com.sentinelone*
sudo rm -rfv /Library/Sentinel
sudo rm -rfv /private/etc/asl/com.sentinelone.sentinel
sudo rm -rfv /usr/local/share/man/man1/sentinelctl.1
@m4rcsch
Copy link
Author

m4rcsch commented Oct 14, 2018

Sometimes there might be still an agent active. just check launchctl then

@sweetw0r
Copy link

Geting zsh: killed launchctl unload /Library/LaunchAgents/com.sentinelone.agent.plist does it mean its kernel extension is enabled?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment