Silently Uninstalling System Extensions on Macs with Symantec M1

When it comes to uninstalling system extensions on Macs, administrators often face a common issue: requiring administrator credentials to complete the process. This can be frustrating for users who need to perform routine maintenance tasks without having to enter admin credentials every time. In this article, we'll explore how to silently uninstall system extensions on Macs with Symantec M1.

The Uninstall API and Code-Signed Apps

To understand how to silently uninstall a system extension, it's essential to comprehend the role of Apple's uninstall API and code-signed apps. The uninstall API must be called from the same code-signed app that is using the system extension. This can be achieved by running a command in the Terminal.

An Example with Santa Tool

A great example of this can be found in the open-source Santa tool created by Google. To trigger this functionality, simply run the following command in the Terminal:

/Applications/Santa.app/Contents/MacOS/santa -unload-system-extension

Two Parts to Silently Uninstalling a System Extension

There are two parts to being able to silently uninstall a system extension. First, the app developer must have written code into their code-signed app that can trigger Apple's uninstall API for system extensions. Second, the administrator must have configured the RemovableSystemExtensions property in the -extension-policy profile payload.

Bypassing Admin Authorization

However, there is a way to bypass admin authorization when uninstalling system extensions. In some cases, removing authorization will also unload the system extension.

RemovableSystemExtensions Property

In macOS Monterey, this issue has been addressed by the addition of the RemovableSystemExtensions property to the -extension-policy profile payload. This property identifies system extensions that can be deactivated without requiring admin authorization.

Silently uninstalling system extensions on Macs with Symantec M1 requires a combination of code-signed apps and configuration of the RemovableSystemExtensions property. By understanding how these components work together, administrators can provide users with a seamless experience when performing routine maintenance tasks.

Symantec m1 mac