This was only tested on a partial SentinelOne installation on the High Sierra beta, where SentinelOne was never allowed to enable it's kernel extension.
-
-
Save m4rcsch/f885c489263f79dd367daf9cecd8281e to your computer and use it in GitHub Desktop.
Remove SentinelOne agent from Mac. Because honestly, it doesn't seem to do anything at all. Run as root, best is to do this from a recovery mode, single user mode with writeable filesystem, ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// list Agents: launchctl list | grep senti | |
//stopping sentinelone | |
launchctl stop com.sentinelone.agent | |
launchctl stop com.sentinelone.sentineld-helper | |
launchctl stop com.sentinelone.sentineld-updater | |
launchctl stop com.sentinelone.sentineld | |
launchctl stop com.sentinelone.sentineld-guard | |
//removing sentinelone | |
launchctl remove com.sentinelone.agent | |
launchctl remove com.sentinelone.sentineld-helper | |
launchctl remove com.sentinelone.sentineld-updater | |
launchctl remove com.sentinelone.sentineld | |
launchctl remove com.sentinelone.sentineld-guard | |
//removing package | |
sudo pkgutil --forget com.sentinelone.pkg.sentinel-agent | |
//removing directories | |
sudo rm -rfv /Library/Extensions/Sentinel.ke* | |
sudo rm -rfv /Library/LaunchAgents/com.sentinelone.agent.plist | |
sudo rm -rfv /Library/LaunchDaemons/com.sentinelone* | |
sudo rm -rfv /Library/Preferences/Logging/Subsystems/com.sentinelone* | |
sudo rm -rfv /Library/Sentinel | |
sudo rm -rfv /private/etc/asl/com.sentinelone.sentinel | |
sudo rm -rfv /usr/local/share/man/man1/sentinelctl.1 |
Geting zsh: killed launchctl unload /Library/LaunchAgents/com.sentinelone.agent.plist
does it mean its kernel extension is enabled?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Sometimes there might be still an agent active. just check launchctl then