How do you uninstall the DLP agent on Mac?

[gnomemade]

Running High Sierra, 10.13.2 with DLP agent version 14.6. How do I uninstall the DLP agent? 

[ali_zainal]

Hi

please check this

https://help.symantec.com/cs/DLP15.0/DLP/v96304134_v120691346/Mac-?locale=EN_US

 

Regards,

Ali

[Migration User]

I was looking to do the same thing but our 14.6 agent install doesn't have the "uninstall_agent" binary.  Is there a similar process for 14.6?  I searched but kept coming back to the article linked above. 

Thanks

Aaron

 

 

 

[Migration User]

I was looking to do the same thing but our 14.6 agent install doesn’t have the “uninstall_agent” binary. Is there a similar process for 14.6? I searched but kept coming back to the linked article for 15.0.

[gnomemade]

Same here, no uninstall_agent binary for my agent install:

 

# pwd
/Library/Manufacturer/Endpoint Agent

# find . -iname \*inst\*
./firefox-extension-uninstaller.xpi
./libffplginst.dylib

# ls
CUI.app                   edpa0.log                          libRE2.dylib                                           libcdc.dylib           libsch.dylib
CUI.plist                 edpa1.log                          libResponseRules.dylib                                 libclpbm.dylib         libscs.dylib
FirefoxRegistryData.json  edpa_ext0.log                      libahm.dylib                                           libcm.dylib            libssl.1.0.0.dylib
Frameworks                edpa_ext1.log                      libamc.dylib                                           libcrypto.1.0.0.dylib  libtl.dylib
MemDumpFiles              firefox-extension-uninstaller.xpi  libappc.dylib                                          libcrypto.dylib        libui.dylib
OperationLogs             fsd.kext                           libas.dylib                                            libcurl.4.dylib        log4cxx_config_matchercore.xml
Resources                 grp.ead                            libasvc.dylib                                          libdc.dylib            ps.ead
Verity                    grp.ead.bk                         libboost_chrono-clang-darwin42-mt-1_54.dylib           libdisc.dylib          ps.ead.bk
am.ead                    imgext                             libboost_date_time-clang-darwin42-mt-1_54.dylib        libffplginst.dylib     rrc.ead
am.ead.bk                 is                                 libboost_filesystem-clang-darwin42-mt-1_54.dylib       libffsobsrvr.dylib     rrc.ead.bk
cg.ead                    is.ead                             libboost_iostreams-clang-darwin42-mt-1_54.dylib        libfsc.dylib           start_agent
cg.ead.bk                 is.ead.bk                          libboost_program_options-clang-darwin42-mt-1_54.dylib  libih.dylib            sto.ead
dcs.ead                   ks.ead                             libboost_regex-clang-darwin42-mt-1_54.dylib            liblog4cxx.dylib       sto.ead.bk
dcs.ead.bk                ks.ead.bk                          libboost_system-clang-darwin42-mt-1_54.dylib           libmsl.dylib           temp
dlp-firefox-addon.xpi     l10n                               libboost_thread-clang-darwin42-mt-1_54.dylib           libotlm.dylib          ttds.ead
edpa                      libIDMCoreDynLib.dylib             libbstrap.dylib                                        libpp.dylib            ttds.ead.bk
edpa.timestamp            libMatcherCoreDyLib.dylib          libbwrm.dylib                                          librtc.dylib

 

[Migration User]

I checked with our security team that manages the DLP servers and they gave me the uninstall_agent binary.  When I attempted to run it on 10.13.2 it causes an immediate Kernel panic and reboots without uninstalling.  However, if I run it on a 10.12.x  or 10.13.1 system it seems to uninstall fine without any issues.  It seems the uninstaller has the same compatibility issues with the OS version that the actual product has.  Very frustrating.

Aaron

 

[Migration User]

Our Security team was able to provide the uninstall_agent binary but when I ran it, the system immediately restarted and got a kernel panic. When I got logged back in DLP was still loaded.  The uninstaller worked fine on 10.12.x and 10.13.1 so it would seem that it has the same compatibility issue as the product on 10.13.2.. very frustrating.

[Migration User]

Apologies for the double posts.. I can never see my posts after they are submitted for some reason.  

[Migration User]

I've been given the steps to manually uninstall by my security department, since they don't have an uninstaller for me. I can confirm that these step work on 10.12.x, but I've not tried them on 10.13.x; I will assume that they are the same for both.

1. Stop the agent services.  See related articles for more information.
   • sudo launchctl unload /Library/LaunchDaemons/com.symantec.manufacturer.agent.plist
2. Delete the Manufacturer folder located in /Library/
   • sudo rm -rf /Library/Manufacturer
3. Delete com.symantec.dlp.edpa.plist and com.symantec.manufacturer.agent.plist from /Library/LaunchDaemons
   • sudo rm -f /Library/LaunchDaemons/com.symantec.dlp.edpa.plist
   • sudo rm -f /Library/LaunchDaemons/com.symantec.manufacturer.agent.plist
4. Delete com.symantec.dlp.edpa.plist and com.symantec.dlp.bom from /Library/Receipts
   • sudo rm -f /Library/Receipts/com.symantec.dlp.edpa.plist
   • sudo rm -f /Library/Receipts/com.symantec.dlp.bom
5. Forget the pkg
   • sudo pkgutil --forget com.symantec.dlp.edpa