Manual Uninstall Procedure for Secure Endpoint Mac Connector

Available Languages

Download Options

  • PDF     (9.8 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (82.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (71.9 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:February 28, 2022
Document ID:216232

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

To uninstall the Secure Endpoint Mac connector, navigate to the installation folder Applications > Cisco AMP (or Cisco AMP for Endpoints on versions 1.14.0 and newer) (Cisco Secure Endpoint for versions 1.18.0 and newer) and double-click the Uninstall AMP for Endpoints Connector.pkg (Uninstall Secure Endpoint connector.pkg on version 1.18.0 and newer) file. Follow the steps in the wizard to uninstall the application.

If for any reason the uninstaller is not successful, the Secure Endpoint Mac connector will have to be manually removed. To do this, open a terminal window and follow the appropriate procedure below. The  procedure to follow depends on the version of the Mac connector being unisntalled and the macOS version.

Manual Uninstall Procedure For Mac Connector Versions Prior to 1.14.0

This uninstall procedure applies to all versions of macOS for Mac Connector versions prior to 1.14.0.

To manually uninstall Mac Connector, run the following commands:

  1. sudo /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist

    If this does not stop the menulet, click on it and select Quit AMP for Endpoints Connector.

  2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist

  3. sudo /bin/launchctl list com.cisco.amp.daemon

    This should yield the message: "Could not find service."

  4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist

  5. sudo /bin/launchctl list com.cisco.amp.updater

    This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.

  6. sudo /sbin/kextunload -b com.cisco.amp.fileop

  7. sudo /sbin/kextunload -b com.cisco.amp.nke

  8. sudo /usr/sbin/kextstat -l | grep com.cisco.amp

    This should yield an empty list.

  9. sudo rm -rf "/Applications/Cisco AMP"

  10. sudo rm -rf /Library/Extensions/ampfileop.kext

  11. sudo rm -rf /Library/Extensions/ampnetworkflow.kext

  12. sudo rm -rf "/Library/Application Support/Cisco/AMP for Endpoints Connector"

  13. sudo rm -rf /opt/cisco/amp/

  14. sudo rm -f /Library/Logs/Cisco/amp*

  15. sudo rm -f /var/run/ampdaemon.pid

  16. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist

  17. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist

  18. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist

  19. sudo pkgutil --forget com.cisco.amp.agent

  20. sudo pkgutil --forget com.cisco.amp.daemon

  21. sudo pkgutil --forget com.cisco.amp.kextsigned

  22. sudo pkgutil --forget com.cisco.amp.kextunsigned

  23. sudo pkgutil --forget com.cisco.amp.support

  24. sudo pkgutil --forget com.sourcefire.amp.agent

  25. sudo pkgutil --forget com.sourcefire.amp.daemon

  26. sudo pkgutil --forget com.sourcefire.amp.kextsigned

  27. sudo pkgutil --forget com.sourcefire.amp.kextunsigned

  28. sudo pkgutil --forget com.sourcefire.amp.support

  29. For each user, remove the following directory if it exists:

    rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist

  30. For each user, remove the following directory if it exists:

    rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist

Manual Uninstall Procedure For Mac Connector Versions 1.14.0 to 1.16.2

The uninstall procedure for Mac Connector versions 1.14.0 and newer varies depending on the version of macOS being used.

To manually uninstall Mac Connector, run the following commands:

  1. /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist
    If this does not stop the menulet, click on it and select Quit AMP for Endpoints Connector.
  2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist
  3. sudo /bin/launchctl list com.cisco.amp.daemon
    This should yield the message: Could not find service.
  4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist
  5. sudo /bin/launchct list com.cisco.amp.updater
    This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.
  6. For macOS versions 10.15 and older:
    sudo /sbin/kextunload -b com.cisco.amp.fileop
  7. For macOS versions 10.15 and older:
    sudo /sbin/kextunload -b com.cisco.amp.nke
  8. For macOS versions 10.15 and older:
    sudo /usr/sbin/kextstat -l | grep com.cisco.amp
    This should yield an empty list.
  9. For macOS versions 11 and newer:
    /Applications/Cisco\ AMP\ for\ Endpoints/AMP\ for\ Endpoints\ Service.app/Contents/MacOS/AMP\ for\ Endpoints\ Service deactivate endpoint_security
    Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.
  10. For macOS versions 11 and newer:
    /Applications/Cisco\ AMP\ for\ Endpoints/AMP\ for\ Endpoints\ Service.app/Contents/MacOS/AMP\ for\ Endpoints\ Service deactivate content_filter
    Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.
  11. For macOS versions 11 and newer:
    systemextensionsctl list | grep com.cisco.endpoint.svc
    All system extensions for     com.cisco.endpoint.svc.networkextension and com.cisco.endpoint.svc.securityextension should be listed with "[terminated waiting to uninstall on reboot]."
  12. For macOS versions 10.15 and older:
    sudo rm -rf "/Applications/Cisco AMP for Endpoints"
  13. For macOS versions 10.15 and older:
    sudo rm -rf /Library/Extensions/ampfileop.kext
  14. For macOS versions 10.15 and older:
    sudo rm -rf /Library/Extensions/ampnetworkflow.kext
  15. sudo rm -rf "/Library/Application Support/Cisco/AMP for Endpoints Connector"
  16. sudo rm -rf /opt/cisco/amp/
  17. sudo rm -f /Library/Logs/Cisco/amp*
  18. sudo rm -f /var/run/ampdaemon.pid
  19. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist
  20. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist
  21. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist
  22. sudo pkgutil --forget com.cisco.amp.agent
  23. sudo pkgutil --forget com.cisco.amp.daemon
  24. sudo pkgutil --forget com.cisco.amp.kextsigned
  25. sudo pkgutil --forget com.cisco.amp.kextunsigned
  26. sudo pkgutil --forget com.cisco.amp.support
  27. sudo pkgutil --forget com.sourcefire.amp.agent
  28. sudo pkgutil --forget com.sourcefire.amp.daemon
  29. sudo pkgutil --forget com.sourcefire.amp.kextsigned
  30. sudo pkgutil --forget com.sourcefire.amp.kextunsigned
  31. sudo pkgutil --forget com.sourcefire.amp.support
  32. For each user, remove the following directory if it exists:
    rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist
  33. For each user, remove the following directory if it exists:
    rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist

Manual Uninstall Procedure For Mac Connector Versions 1.18.0 and newer

The uninstall procedure for Mac connector versions 1.18.0 and newer varies depending on the version of macOS being used.

To manually uninstall Mac connector, run the following commands:

  1. /bin/launchctl unload /Library/LaunchAgents/com.cisco.amp.agent.plist
    If this does not stop the menulet, click on it and select Quit Secure Endpoint connector.
  2. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.daemon.plist
  3. sudo /bin/launchctl list com.cisco.amp.daemon
    This should yield the message: Could not find service.
  4. sudo /bin/launchctl unload /Library/LaunchDaemons/com.cisco.amp.updater.plist
  5. sudo /bin/launchct list com.cisco.amp.updater
    This should yield the message: Could not find service "com.cisco.amp.updater" in domain for system.
  6. For macOS versions 10.15 and older:
    sudo /sbin/kextunload -b com.cisco.amp.fileop
  7. For macOS versions 10.15 and older:
    sudo /sbin/kextunload -b com.cisco.amp.nke
  8. For macOS versions 10.15 and older:
    sudo /usr/sbin/kextstat -l | grep com.cisco.amp
    This should yield an empty list.
  9. For macOS versions 11 and newer:

    /Applications/Cisco\ Secure\ Endpoint/Secure\ Endpoint\ Service.app/Contents/MacOS/Secure\ Endpoint\ Service deactivate endpoint_security

    Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.
  10. For macOS versions 11 and newer:

    /Applications/Cisco\ Secure\ Endpoint/Secure\ Endpoint\ Service.app/Contents/MacOS/Secure\ Endpoint\ Service deactivate content_filter

    Enter password when prompted. Note that this step cannot be executed remotely as the local user is required to enter the password.
  11. For macOS versions 11 and newer:
    systemextensionsctl list | grep com.cisco.endpoint.svc
    All system extensions for     com.cisco.endpoint.svc.networkextension and com.cisco.endpoint.svc.securityextension should be listed with "[terminated waiting to uninstall on reboot]."
  12. For macOS versions 10.15 and older:
    sudo rm -rf "/Applications/Cisco Secure Endpoints"
  13. For macOS versions 10.15 and older:
    sudo rm -rf /Library/Extensions/ampfileop.kext
  14. For macOS versions 10.15 and older:
    sudo rm -rf /Library/Extensions/ampnetworkflow.kext
  15. sudo rm -rf "/Library/Application Support/Cisco/Secure Endpoint"
  16. sudo rm -rf /opt/cisco/amp/
  17. sudo rm -f /Library/Logs/Cisco/amp*
  18. sudo rm -f /var/run/ampdaemon.pid
  19. sudo rm -f /Library/LaunchAgents/com.cisco.amp.agent.plist
  20. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.daemon.plist
  21. sudo rm -f /Library/LaunchDaemons/com.cisco.amp.updater.plist
  22. sudo pkgutil --forget com.cisco.amp.agent
  23. sudo pkgutil --forget com.cisco.amp.daemon
  24. sudo pkgutil --forget com.cisco.amp.kextsigned
  25. sudo pkgutil --forget com.cisco.amp.kextunsigned
  26. sudo pkgutil --forget com.cisco.amp.support
  27. sudo pkgutil --forget com.sourcefire.amp.agent
  28. sudo pkgutil --forget com.sourcefire.amp.daemon
  29. sudo pkgutil --forget com.sourcefire.amp.kextsigned
  30. sudo pkgutil --forget com.sourcefire.amp.kextunsigned
  31. sudo pkgutil --forget com.sourcefire.amp.support
  32. For each user, remove the following directory if it exists:
    rm -f ~/Library/Preferences/SourceFire-Inc.FireAMP-Mac.plist
  33. For each user, remove the following directory if it exists:
    rm -f ~/Library/Preferences/Cisco-Inc.AMP-for-Endpoints-Connector.plist

Revision History

Revision Publish Date Comments
2.0
28-Feb-2022
Connector rebranding
1.0
05-Nov-2020
Initial Release
TAC Authored

Contributed by Cisco Engineers

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products