Non-Casper machine with Restricted Software

[ImAMacGuy]

I have a user that somehow managed to get restricted software running on their system. but it's not managed by casper. I'm thinking he restored a time machine backup from his work machine's backup to her personal machine.

is there any way to remove this without wiping out the system?

[JPDyson]

The deadly Shaolin rm command?

[mm2270]

If he restored, he might have the jamf binary on the system

which jamf

If yes, you can probably just do a sudo jamf removeFramework.

If that doesn't do it, you'll need to disable and delete all the LaunchAgents and LaunchDaemons from JAMF on the system.
I forget now which one controls the Restricted Software process, but I think its the jamf.daemon one.

I would also delete the /Library/Application Support/JAMF/ directory.

[hkim]

Remove the affected software without enrolling it back into JSS? I guess depending on what access you have to the machine, the answer is "It Depends". I'm re-reading the original post with his and her and I'm just confuzzled.

[ImAMacGuy]

@hkim - sorry it's just his and his... I typoed. I tried to enroll in the JSS, but it always returned that it couldn't connect. So I tried the jamf removeFramework and lo and behold that worked perfectly.

Thank you for all your quick responses!!!