Skip to main content

Hello friends,

I need to uninstall Carbon Black on all company devices. The app bundle includes a shell script to uninstall it, so I thought I could run a command with the Files & Processes payload of a policy. It looks like this:

sh /Applications/VMware\\ Carbon\\ Black\\ EDR.app/Contents/Resources/sensoruninst.sh
It works, but the user gets prompted to approve deleting the system extensions. 
 
I tried copying the sensoruninst.sh and pasting it into a script in Jamf, then adding the script to a policy. That does not work, returning this message:
VMware Carbon Black EDR Uninstaller Copyright 2016-2021 VMware, Inc. All rights reserved Uninstalls the VMware Carbon Black EDR sensor. Must be run as root. Options: -d [ d ] Keep local sensor data.
 
Maybe what I want to do is not possible but I thought I'd check here. Do any of you know if it's possible to uninstall this thing without user intervention? Any insight and suggestions are welcome. 
 
Thank you 
 
 

@JDaher You could remove the Configuration Profile that allows the Carbon Black System Extension to run which should then allow the uninstall script to run. I don't know what that would to to a running instance of Carbon Black though, so may be better to re-deploy the Configuration Profile with the extension set to be removable.

Another option would be to use the technique documented in https://derflounder.wordpress.com/2021/10/26/silently-uninstalling-system-extensions-on-macos-monterey-and-earlier/ 

@JDaher You could remove the Configuration Profile that allows the Carbon Black System Extension to run which should then allow the uninstall script to run. I don't know what that would to to a running instance of Carbon Black though, so may be better to re-deploy the Configuration Profile with the extension set to be removable.

Another option would be to use the technique documented in https://derflounder.wordpress.com/2021/10/26/silently-uninstalling-system-extensions-on-macos-monterey-and-earlier/ 


Thank you @sdagley. It looks like removing the configuration profile before uninstalling gets rid of the prompt. However, after it uninstalls and I run systemextensionsctl list the Carbon Black extension is still listed, although it says it's uninstalling. Don't know if it will eventually disappear from the list, or if it even matters:

com.carbonblack.es-loader.es-extension (7.2.1.16597/7.2.1.16597) es-extension [uninstalling]

Thank you @sdagley. It looks like removing the configuration profile before uninstalling gets rid of the prompt. However, after it uninstalls and I run systemextensionsctl list the Carbon Black extension is still listed, although it says it's uninstalling. Don't know if it will eventually disappear from the list, or if it even matters:

com.carbonblack.es-loader.es-extension (7.2.1.16597/7.2.1.16597) es-extension [uninstalling]


@JDaher Rebooting should allow the extension to fully removed

@JDaher Rebooting should allow the extension to fully removed


@sdagley It doesn't get removed, even after a few reboots it stays listed as uninstalling. But your other suggestion worked very well: to re-deploy the Configuration Profile with the extension set to be removable. No prompts for the user and the extension does uninstall after a reboot. Thank you so much, I really appreciate the assist. 

Reply


Terms & ConditionsCookie settings