Removing Backup & Sync and related files using script for Intel-based MacBooks on Big Sur

[rshepherd]

We're currently experiencing the issue of Intel-based Macs on Big Sur needing permissions to upgrade the B&S app to Google Drive For Desktop. I have a config profile made with a PPPC, Approved Kernel Extensions, and System Extensions payloads to bypass needing admin credentials entered to make those changes, though I've found that on a few machines running Catalina 10.15.7 that have Backup & Sync installed, it still asks for permissions changes that require admin credentials entered before the app is updated/changed--ones that are doing a fresh install of GDfD via Self Service policy don't seem to be affected. Is there a script I can use that will fully remove Backup & Sync and associated files, in order to attempt a fresh install of GDfD?

[MatthewGC]

Sorry to sidetrack the thread a little but have you been able to get Google Drive to even work on BS? I've been playing with it as well and have run into kernel extension issues, even though I approved one, perhaps there are more that I didn't see? Regardless even when disabled SIP in recovery mode it would work but as soon as I enabled SIP again it stopped work again without ever prompting in S&P. I found a lot of threads from people having similar issues. 

[rshepherd]

The few test machines we've tried it on seemed to have worked, though I know it's possible that could change day-to-day. It seems that users that do a fresh install of GDfD via our Self Service policy are unaffected as of yet, but the ones who had either B&S or GFS installed before updating the app are still getting S&P permissions errors.

This is the config profile we're using:

I referenced @Geissbuhler 's posts in this thread to build it--not a complete fix but has seemed to work on machines fitting certain criteria.

[rshepherd]

Alright now its asking users for S&P permissions again, so I suppose this doesn't work yet...

[MatthewGC]

We're a Google Workplace enterprise customer so I opened a case with them after messing with it some more and was not able to get it to work without disabling SIP. I'll let you know what they come back with.

[rshepherd]

Awesome, much appreciated!

[rshepherd]

My chat with Google Enterprise Support basically resulted in the support rep telling me "that is beyond the scope of what we can do"...hopefully you and others have better luck.

[rshepherd]

Well we figured out how to remove B&S using a preinstall script in Composer, but now users are being prompted for S&P permissions again, so the config profile doesn't work like I previously thought. 😞

[rshepherd]

In the System Extensions payload I had made, I had "Allowed Team Identifiers" selected from the drop-down menu, when I should've had "Allowed System Extensions" selected. This paired with our script for removing B&S seems to work--users are not restricted by admin credentials and just have to follow on-screen prompts...for now!