Help CenterBefore uninstalling the ThreatLocker MAC Agent, you must turn off the Tamper Protection Feature in the ThreatLocker Portal. For instructions on how to disable Tamper Protection, please consult the following article:
Disable Tamper Protection | ThreatLocker Help Center (kb.help)
Before the Mac Agent can be uninstalled, you must stop the ThreatLocker process.
For Mac Agent versions less than 3.1:
- Select the ThreatLocker icon, located in the tray in the top right section of the screen. Select 'Quit' from the dropdown menu.
For Mac Agent versions 3.1 and above:
- Open 'Activity Monitor'.
- You can locate this via 'Spotlight Search' by selecting the magnifying glass icon from the top right section of the screen.
Once open, you can search for 'activity' using the provided search field.
-
- Alternatively, you can open 'Activity Monitor' by selecting the 'Utilities' folder from within 'Applications'.
- Once 'Activity Monitor' is opened, search for 'threatlocker' in the provided search bar. Select the running ThreatLocker process, then select the 'x' button to kill it.
Open Terminal by navigating to Finder > Applications > Utilities and selecting it from the list of applications. You can also find it via Spotlight Search.
Once open, run the following command in Terminal:
open /Applications/ThreatLocker.app --args -uninstall
This command will delete the baseline. This is especially important if you are removing the ThreatLocker App to reinstall it.
In order for the machine to be deleted from the 'Devices' page, it must say that it is 'Offline'. This will reflect in the portal after 15 minutes of not checking in.
Once the machine shows that it is offline, you can delete it from your organization. From within the 'Devices' page, select the machine you have uninstalled the agent from, then select the 'Delete' button.
Uninstalling with MDM
Note: Before uninstalling, you must remove the ThreatLocker Configuration profile from your Mac devices. Failing to do so will result in an error during uninstallation.
The remaining steps are automated via a script which can be found here. Otherwise, they can be manually completed following the steps above.