- Jamf Nation Community
- Products
- Jamf Pro
- Uninstalling VMware Carbon Black EDR Without User ...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-10-2023 07:30 PM - edited 07-10-2023 07:34 PM
Hello friends,
I need to uninstall Carbon Black on all company devices. The app bundle includes a shell script to uninstall it, so I thought I could run a command with the Files & Processes payload of a policy. It looks like this:
sh /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Resources/sensoruninst.sh
It works, but the user gets prompted to approve deleting the system extensions.
I tried copying the sensoruninst.sh and pasting it into a script in Jamf, then adding the script to a policy. That does not work, returning this message:
VMware Carbon Black EDR Uninstaller Copyright 2016-2021 VMware, Inc. All rights reserved Uninstalls the VMware Carbon Black EDR sensor. Must be run as root. Options: -d [ d ] Keep local sensor data.
Maybe what I want to do is not possible but I thought I'd check here. Do any of you know if it's possible to uninstall this thing without user intervention? Any insight and suggestions are welcome.
Thank you
Solved! Go to Solution.
1 ACCEPTED SOLUTION
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-11-2023 06:22 AM
@JDaher You could remove the Configuration Profile that allows the Carbon Black System Extension to run which should then allow the uninstall script to run. I don't know what that would to to a running instance of Carbon Black though, so may be better to re-deploy the Configuration Profile with the extension set to be removable.
Another option would be to use the technique documented in https://derflounder.wordpress.com/2021/10/26/silently-uninstalling-system-extensions-on-macos-monter...
4 REPLIES 4
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-11-2023 06:22 AM
@JDaher You could remove the Configuration Profile that allows the Carbon Black System Extension to run which should then allow the uninstall script to run. I don't know what that would to to a running instance of Carbon Black though, so may be better to re-deploy the Configuration Profile with the extension set to be removable.
Another option would be to use the technique documented in https://derflounder.wordpress.com/2021/10/26/silently-uninstalling-system-extensions-on-macos-monter...
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-11-2023 01:04 PM
Thank you @sdagley. It looks like removing the configuration profile before uninstalling gets rid of the prompt. However, after it uninstalls and I run systemextensionsctl list the Carbon Black extension is still listed, although it says it's uninstalling. Don't know if it will eventually disappear from the list, or if it even matters:
com.carbonblack.es-loader.es-extension (7.2.1.16597/7.2.1.16597) es-extension [uninstalling]
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-11-2023 07:00 PM
@JDaher Rebooting should allow the extension to fully removed
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-14-2023 02:30 PM
@sdagley It doesn't get removed, even after a few reboots it stays listed as uninstalling. But your other suggestion worked very well: to re-deploy the Configuration Profile with the extension set to be removable. No prompts for the user and the extension does uninstall after a reboot. Thank you so much, I really appreciate the assist.
