Skip to content

Instantly share code, notes, and snippets.

@rafaelmaeuer

rafaelmaeuer/remove-system-extensions.md

Last active October 3, 2024 16:53
Show Gist options
  • Save rafaelmaeuer/a9132407fd7fc1ac64d026a2fd4c0550 to your computer and use it in GitHub Desktop.
Save rafaelmaeuer/a9132407fd7fc1ac64d026a2fd4c0550 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
remove-system-extensions.md

To avoid any misunderstandings, I'm talking about stuff that you would find under

/Library/SystemExtensions/

Usually sitting in a folder with a cryptic folder named like AAHHV55HIWJF&VHDI9 and often containing an item like com.nordvpn.macOS.Shield.systemextension.

This is not about the Finder extensions that you would normally find in the System Settings app.

It is actually in my case said NordVPN Shield system extensiont that I just couldn't remove even using sudo via the Terminal. Here's what to do (only works on Intel Macs, I don't know how to get into recovery mode on Apple Silicon Macs).

  1. Reboot into recovery mode (restart and hold down ⌘+R)

  2. Under the menu item Utilities launch Terminal app

  3. Enter csrutil disable to disable System Integrity Protection (SIP)

  4. Reboot again

  5. Now open the Terminal.app

  6. Enter systemextensionsctl list and hit return

  7. You'll get a list of all installed system extensions that looks something like this:

    --- com.apple.system_extension.endpoint_security   
enabled active teamID     bundleID                 (version)   name       [state]   
*       *      W5W395V82Y com.nordvpn.macos.Shield (1.0.54/51) NordVPN Threat Protection [activated enabled]

    Note the teamID and the bundleID of the system extensions you want to uninstall, we'll use those in a second.

  8. In my case you'd enter sudo systemextensionsctl uninstall W5W395V82Y com.nordvpn.macOS.Shield in the Terminal and hit return. As a general formula it would be: sudo systemextensionsctl uninstall teamID bundleID

  9. If everything went well you should get feedback that says Success

  10. Now you can go to the Finder and remove the files/folders of the extensions you wanted to get rid of in /Library/SystemExtensions. Just drag them to the trash. You'll be asked for an admin password and that's it.

  11. Reboot again in recovery mode (see point 1.)

  12. Under the menu item Utilities launch Terminal app

  13. Enter csrutil enable to re-enable the SIP

  14. Reboot again and live a happy life ever after.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment