Resolve macOS Sensor Upgrade or Install Error due to Existing System Extension

Prior to macOS sensor 3.8, you could not uninstall the System Extension without first disabling System Integrity Protection (SIP). This topic presents a solution to that problem.

In some cases, the installation or upgrade of a macOS 3.51+ sensor fails with the following error message in the Preinstall log:

failed to uninstall system extension
program terminated with error code: 4096

If you check Systemextensionsctl, Carbon Black Cloud errantly displays as installed:

sudo Systemextensionsctl list

--- com.apple.system_extension.endpoint_security
enabled active teamID bundleID (version) name [state]
* * 7AGZNQ2S2T com.vmware.carbonblack.cloud.se-agent.extension (3.5.2fc76/3.5.2fc76) com.vmware.carbonblack.cloud.se-agent.extension [activated enabled]

To correct this issue without disabling SIP, perform the following procedure.

Procedure

1. Download a macOS 3.8+ sensor DMG to the affected assets.
2. Go to the docs/ directory of the sensor DMG.
3. Run CBCloud Cleanup Tool.pkg and follow the onscreen instructions.
   Note: The CBCloud Cleanup Tool.pkg will not remove the system extension if the asset is in a healthy, installed state.
   Upon successful completion, the system extension is in the [Terminated waiting to uninstall on reboot] state. A reboot is not required.
4. Proceed to install or upgrade the sensor.