Stop and start Symantec Endpoint Protection on OS X

README.md

This script enables you stop and start Symantec Endpoint Protection on OS X

Installation

sudo curl https://gist.githubusercontent.com/steve-jansen/61a189b6ab961a517f68/raw/sep -o /usr/local/bin/sep
sudo chmod 755 /usr/local/bin/sep
sudo chown root:staff /usr/local/bin/sep

/etc/sudoers

If your user account is not a member of the admin group (i.e., not an OS X Administrator), you need to add the following line to /etc/sudoers using sudo visudo tool:

myusername ALL= NOPASSWD: /usr/local/bin/sep

Example

me:~$ sep stop
/usr/local/bin/sep: relaunching as sudo /usr/local/bin/sep
/usr/local/bin/sep: unloading Symantec Endpoint Protection daemon
/usr/local/bin/sep: unloading Symantec Endpoint Protection shared settings daemon
/usr/local/bin/sep: closing Symantec Endpoint Protection UI widget

me:~$ sudo /usr/local/bin/sep start
/usr/local/bin/sep: relaunching as sudo /usr/local/bin/sep
/usr/local/bin/sep: loading Symantec Endpoint Protection daemon
/usr/local/bin/sep: unloading Symantec Endpoint Protection shared settings daemon
/usr/local/bin/sep: launching Symantec Endpoint Protection UI widget

sep

#!/bin/bash

# relaunch with sudo if we aren't root
if [[ $EUID -ne 0 ]]; then
   echo "$0: relaunching as sudo $0 $1 $USER"
   sudo "$0" $1 $USER
   exit $?
fi

real_user=$USER
if [ -n "$2" ]; then
  real_user=$2
fi

stop() {
  echo $0: unloading Symantec Endpoint Protection daemon
  launchctl unload /Library/LaunchDaemons/com.symantec.symdaemon.*plist

  echo $0: unloading Symantec Endpoint Protection shared settings daemon
  launchctl unload /Library/LaunchDaemons/com.symantec.sharedsettings.*plist

  echo $0: closing Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl unload /Library/LaunchAgents/com.symantec.uiagent.application.*plist
}

start() {
  echo $0: loading Symantec Endpoint Protection daemon
  launchctl load /Library/LaunchDaemons/com.symantec.symdaemon.*plist

  echo $0: loading Symantec Endpoint Protection shared settings daemon
  launchctl load /Library/LaunchDaemons/com.symantec.sharedsettings.*plist

  echo $0: launching Symantec Endpoint Protection UI widget as $real_user
  sudo -u $real_user launchctl load /Library/LaunchAgents/com.symantec.uiagent.application.*plist
}

case "$1" in
  start)
    start
    ;;
  stop)
    stop
    ;;
  *)
    echo "Usage: $0 [start|stop]"
    ;;
esac

@crkrenn, I can confirm that I can see the same team ID '9PTGMPNXZ2' for 'com.symantec.mes.systemextension' but I also see another service with following ID:

enabled	active	teamID	bundleID (version)	name	[state]
*	*	Y2CCP3S9W7	com.broadcom.mes.systemextension (9.0.4/9.0.4)	Symantec System Extension	[activated enabled]

I uninstalled both.

UPDATED:

Like previous commenters have noted, once I run sep stop then the machine cannot not access internet at all. (Even with com.broadcom.mes.systemextension already deactivated and uninstalled.

Thanks, Very helpful 👍

Thank you so much !

It did not kill com.broadcom.mes.systemextension? How to include some process to kill mentioned process?