Uninstall macOS Sensors Directly on Endpoints

You can use the following procedures to directly uninstall Carbon Black EDR macOS sensors on endpoints.

Prerequisites

You must have access to an administrator account or be assigned to an Analyst team that has uninstall sensor privileges for the appropriate sensor group.

Procedure

• ♦ On the macOS endpoint where the sensor is installed, run the following command:

  /Applications/CarbonBlack/sensoruninst.sh

  After this process is complete, the endpoint stops reporting events and binaries to the Carbon Black EDR server and all caching information for logs is deleted.