Help CenterBefore uninstalling the ThreatLocker MAC Agent, you must turn off the Tamper Protection Feature in the ThreatLocker Portal. For instructions on how to disable Tamper Protection, please consult the following article:
Disable Tamper Protection | ThreatLocker Help Center (kb.help)
Before the Mac Agent can be uninstalled, you must stop the ThreatLocker process.
For Mac Agent versions less than 3.1:
- Select the ThreatLocker icon, located in the tray in the top right section of the screen. Select 'Quit' from the dropdown menu.
For Mac Agent versions 3.1 and above:
- Open 'Activity Monitor'.
- You can locate this via 'Spotlight Search' by selecting the magnifying glass icon from the top right section of the screen.
Once open, you can search for 'activity' using the provided search field.
-
- Alternatively, you can open 'Activity Monitor' by selecting the 'Utilities' folder from within 'Applications'.
- Once 'Activity Monitor' is opened, search for 'threatlocker' in the provided search bar. Select the running ThreatLocker process, then select the 'x' button to kill it.
Open Terminal by navigating to Finder > Applications > Utilities and selecting it from the list of applications. You can also find it via Spotlight Search.
Once open, run the following command in Terminal:
open /Applications/ThreatLocker.app --args -uninstall
This command will delete the baseline. This is especially important if you are removing the ThreatLocker App to reinstall it.
In order for the machine to be deleted from the 'Devices' page, it must say that it is 'Offline'. This will reflect in the portal after 15 minutes of not checking in.
Once the machine shows that it is offline, you can delete it from your organization. From within the 'Devices' page, select the machine you have uninstalled the agent from, then select the 'Delete' button.
Uninstalling with MDM
To silently uninstall the ThreatLocker Mac Agent using an MDM solution, additional prerequisites must be met to ensure the uninstall process is not blocked by built-in protections, such as Tamper Protection, or by enforced configuration profiles.
Prerequisites
ThreatLocker deployments using MDM typically rely on a two-part Configuration Profile setup. Under normal operation, both profiles are installed and actively enforce protections on the device.
Uninstall Process
-
Remove the “ThreatLocker Startup & Lock” Configuration Profile - Before initiating the uninstall, instruct your MDM to remove the Configuration Profile labeled “ThreatLocker Startup & Lock.”
-
The Startup & Lock profile prevents anything from deactivating or removing the ThreatLocker System Extension.
-
IMPORTANT NOTE: Do not remove the “ThreatLocker Configuration” profile. This profile must remain in place to grant the agent Full Disk Access, which is required for the uninstall process to complete successfully.
-
-
Disable Tamper Protection - In the ThreatLocker Portal, disable Tamper Protection for the target device(s). For information on how to disable Tamper Protection, please refer to the following article:
-
Enable Silent Uninstall - In the ThreatLocker Portal, set the “AllowSilentUninstall” option on the applicable device or device group. For information on how to add an Option, please refer to the following article:
-
-
This explicitly permits the agent to be removed without user interaction.
-
-
Confirm Policy Sync - Ensure the device has received and applied all changes from Steps 1–3.
-
-
This may require a device check-in or manual sync, depending on your MDM.
-
-
Deploy the Uninstall Script via MDM - Once all prerequisites are satisfied, push the official uninstall script through your MDM solution. The uninstall script can be found here.
-
Verify Removal - After successful execution:
-
The ThreatLocker agent will be removed from the device.
-
-
-
The device will no longer appear in the ThreatLocker Portal.
-
Please Note: Skipping any of the above steps may result in the uninstall failing. Timing and policy propagation are critical, so ensure devices are fully synchronized before executing the uninstall script.