Contents

Manual Uninstall Procedure For Mac Connector Versions Prior to 1.14.0

Manual Uninstall Procedure For Mac Connector Versions 1.14.0 to 1.16.2

Manual Uninstall Procedure For Mac Connector Versions 1.18.0 and newer

To uninstall the Secure Endpoint Mac connector, navigate to the installation folder Applications > Cisco AMP (or Cisco AMP for Endpoints on versions 1.14.0 and newer) (Cisco Secure Endpoint for versions 1.18.0 and newer) and double-click the Uninstall AMP for Endpoints Connector.pkg (Uninstall Secure Endpoint connector.pkg on version 1.18.0 and newer) file. Follow the steps in the wizard to uninstall the application.

If for any reason the uninstaller is not successful, the Secure Endpoint Mac connector will have to be manually removed. To do this, open a terminal window and follow the appropriate procedure below. The  procedure to follow depends on the version of the Mac connector being unisntalled and the macOS version.

Manual Uninstall Procedure For Mac Connector Versions Prior to 1.14.0

This uninstall procedure applies to all versions of macOS for Mac Connector versions prior to 1.14.0.

To manually uninstall Mac Connector, run the following commands:

1. sudo /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist

If this does not stop the menulet, click on it and select Quit AMP for Endpoints Connector.

2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist

3. sudo /bin/launchctl list com.cisco.amp.daemon

This should yield the message: "Could not find service."

4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist

5. sudo /bin/launchctl list com.cisco.amp.updater

This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.

6. sudo /sbin/kextunload -b com.cisco.amp.fileop

7. sudo /sbin/kextunload -b com.cisco.amp.nke

8. sudo /usr/sbin/kextstat -l | grep com.cisco.amp

This should yield an empty list.

9. sudo rm -rf "/Applications/Cisco AMP"

10. sudo rm -rf /Library/Extensions/ampfileop.kext

11. sudo rm -rf /Library/Extensions/ampnetworkflow.kext

12. sudo rm -rf "/Library/Application Support/Cisco/AMP for Endpoints Connector"

13. sudo rm -rf /opt/cisco/amp/

14. sudo rm -f /Library/Logs/Cisco/amp*

15. sudo rm -f /var/run/ampdaemon.pid

16. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist

17. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist

18. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist

19. sudo pkgutil --forget com.cisco.amp.agent

20. sudo pkgutil --forget com.cisco.amp.daemon

21. sudo pkgutil --forget com.cisco.amp.kextsigned

22. sudo pkgutil --forget com.cisco.amp.kextunsigned

23. sudo pkgutil --forget com.cisco.amp.support

24. sudo pkgutil --forget com.sourcefire.amp.agent

25. sudo pkgutil --forget com.sourcefire.amp.daemon

26. sudo pkgutil --forget com.sourcefire.amp.kextsigned

27. sudo pkgutil --forget com.sourcefire.amp.kextunsigned

28. sudo pkgutil --forget com.sourcefire.amp.support

29. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist

30. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist

Manual Uninstall Procedure For Mac Connector Versions 1.14.0 to 1.16.2

The uninstall procedure for Mac Connector versions 1.14.0 and newer varies depending on the version of macOS being used.

To manually uninstall Mac Connector, run the following commands:

1. /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist

If this does not stop the menulet, click on it and select Quit AMP for Endpoints Connector.

2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist

3. sudo /bin/launchctl list com.cisco.amp.daemon

This should yield the message: Could not find service.

4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist

5. sudo /bin/launchct list com.cisco.amp.updater

This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.

6. For macOS versions 10.15 and older:

sudo /sbin/kextunload -b com.cisco.amp.fileop

7. For macOS versions 10.15 and older:

sudo /sbin/kextunload -b com.cisco.amp.nke

8. For macOS versions 10.15 and older:

sudo /usr/sbin/kextstat -l | grep com.cisco.amp

This should yield an empty list.

9. For macOS versions 11 and newer:

/Applications/Cisco\ AMP\ for\ Endpoints/AMP\ for\ Endpoints\ Service.app/Contents/MacOS/AMP\ for\ Endpoints\ Service deactivate endpoint_security

Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.

10. For macOS versions 11 and newer:

/Applications/Cisco\ AMP\ for\ Endpoints/AMP\ for\ Endpoints\ Service.app/Contents/MacOS/AMP\ for\ Endpoints\ Service deactivate content_filter

Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.

11. For macOS versions 11 and newer:

systemextensionsctl list | grep com.cisco.endpoint.svc

All system extensions for com.cisco.endpoint.svc.networkextension and com.cisco.endpoint.svc.securityextension should be listed with "[terminated waiting to uninstall on reboot]."

12. For macOS versions 10.15 and older:

sudo rm -rf "/Applications/Cisco AMP for Endpoints"

13. For macOS versions 10.15 and older:

sudo rm -rf /Library/Extensions/ampfileop.kext

14. For macOS versions 10.15 and older:

sudo rm -rf /Library/Extensions/ampnetworkflow.kext

15. sudo rm -rf "/Library/Application Support/Cisco/AMP for Endpoints Connector"

16. sudo rm -rf /opt/cisco/amp/

17. sudo rm -f /Library/Logs/Cisco/amp*

18. sudo rm -f /var/run/ampdaemon.pid

19. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist

20. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist

21. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist

22. sudo pkgutil --forget com.cisco.amp.agent

23. sudo pkgutil --forget com.cisco.amp.daemon

24. sudo pkgutil --forget com.cisco.amp.kextsigned

25. sudo pkgutil --forget com.cisco.amp.kextunsigned

26. sudo pkgutil --forget com.cisco.amp.support

27. sudo pkgutil --forget com.sourcefire.amp.agent

28. sudo pkgutil --forget com.sourcefire.amp.daemon

29. sudo pkgutil --forget com.sourcefire.amp.kextsigned

30. sudo pkgutil --forget com.sourcefire.amp.kextunsigned

31. sudo pkgutil --forget com.sourcefire.amp.support

32. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist

33. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist

Manual Uninstall Procedure For Mac Connector Versions 1.18.0 and newer

The uninstall procedure for Mac connector versions 1.18.0 and newer varies depending on the version of macOS being used.

To manually uninstall Mac connector, run the following commands:

1. /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist

If this does not stop the menulet, click on it and select Quit Secure Endpoint connector.

2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist

3. sudo /bin/launchctl list com.cisco.amp.daemon

This should yield the message: Could not find service.

4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist

5. sudo /bin/launchct list com.cisco.amp.updater

This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.

6. For macOS versions 10.15 and older:

sudo /sbin/kextunload -b com.cisco.amp.fileop

7. For macOS versions 10.15 and older:

sudo /sbin/kextunload -b com.cisco.amp.nke

8. For macOS versions 10.15 and older:

sudo /usr/sbin/kextstat -l | grep com.cisco.amp

This should yield an empty list.

9. For macOS versions 11 and newer:

/Applications/Cisco\ Secure\ Endpoint/Secure\ Endpoint\ Service.app/Contents/MacOS/Secure\ Endpoint\ Service deactivate endpoint_security

Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.

10. For macOS versions 11 and newer:

/Applications/Cisco\ Secure\ Endpoint/Secure\ Endpoint\ Service.app/Contents/MacOS/Secure\ Endpoint\ Service deactivate content_filter

Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.

11. For macOS versions 11 and newer:

systemextensionsctl list | grep com.cisco.endpoint.svc

All system extensions for com.cisco.endpoint.svc.networkextension and com.cisco.endpoint.svc.securityextension should be listed with "[terminated waiting to uninstall on reboot]."

12. For macOS versions 10.15 and older:

sudo rm -rf "/Applications/Cisco Secure Endpoints"

13. For macOS versions 10.15 and older:

sudo rm -rf /Library/Extensions/ampfileop.kext

14. For macOS versions 10.15 and older:

sudo rm -rf /Library/Extensions/ampnetworkflow.kext

15. sudo rm -rf "/Library/Application Support/Cisco/Secure Endpoint"

16. sudo rm -rf /opt/cisco/amp/

17. sudo rm -f /Library/Logs/Cisco/amp*

18. sudo rm -f /var/run/ampdaemon.pid

19. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist

20. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist

21. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist

22. sudo pkgutil --forget com.cisco.amp.agent

23. sudo pkgutil --forget com.cisco.amp.daemon

24. sudo pkgutil --forget com.cisco.amp.kextsigned

25. sudo pkgutil --forget com.cisco.amp.kextunsigned

26. sudo pkgutil --forget com.cisco.amp.support

27. sudo pkgutil --forget com.sourcefire.amp.agent

28. sudo pkgutil --forget com.sourcefire.amp.daemon

29. sudo pkgutil --forget com.sourcefire.amp.kextsigned

30. sudo pkgutil --forget com.sourcefire.amp.kextunsigned

31. sudo pkgutil --forget com.sourcefire.amp.support

32. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist

33. For each user, remove the following directory if it exists:

rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist