Manually uninstall MAC S1 Agent
To manually remove the Sentinel One agent, please follow these steps:
Easy Mode: https://support.sentinelone.com/hc/en-us/articles/207789659-Uninstall-OSX-agent-with-anti-tampering-on
Follow these steps if the management console is not available and an agent needs to be removed from the endpoint.
• Restart the Mac in recovery mode
• In terminal go to
•
• /Library/Sentinel/sentinel-agent.bundle/Contents/Resources
• Run
•
• /Volumes/Macintosh\ HD/Library/Sentinel/sentinel-agent.bundle/Contents/Resources/uninstall.sh /Volumes/Macintosh\ HD
If that doesn't work, follow these steps:
• Shutdown or force shutdown if normal shutdown is not working
• Power on and right away press and hold Command+R to load into recovery mode
• When Apple logo and loading bar show up, you can let go command+R
• When the recovery mode menu appears, do the following:
• If HD encrypted with File Vault, open disk utility and unlock the drive
• Utilities --> Terminal
• cd "/Volumes/Macintosh HD/Library/Extensions"
• The following may require sudo
• rm -rf Sentinel.kext
• rm -rf SentinelWall.kext
• kextcache -invalidate "/Volumes/Macintosh HD"
•
• If HD was encrypted, there may be a short wait after the above step if the process needs to wait to get control of the volume
• Reboot the system
• Open terminal
•
• cd /Library/Sentinel/sentinel-agent.bundle/Contents/Resources
• sudo ./uninstall.sh