Unable to delete endpoint and network system extensions

A few weeks ago I had problems with provisioning profiles for some macOS programs, so I deleted/revoked a bunch of certificates and provisioning profiles and started from scratch. (Everything seems to be working for me)

Unfortunately, a co-worker had two programs on his machine that were built with the old, test provisioning profiles with the revoked certificates, and it seems this may be preventing him from deleting the system extensions.

The apps have been deleted, but that does not delete the system extensions. I installed a new program that programmatically (tries to) uninstall the system extension, but it doesn't seem to work either.

When he reboots his computer, macOS pops up a window showing that the extensions may be malware. If he clicks "Show in Finder" and then tries to delete the system extensions from the Finder, he gets the message:

The operation can't be completed because you don't have permission to access some of the items.

Is it possible to delete the old system extensions that were installed with the old provisioning profiles? Are there multiple files that need to be deleted (e.g., the system extension and a .plist file somewhere)?

Answered by Todd_at_Ennetix in 771521022

Reviewing some of my old notes and searching online, the best answer I can come up with is:

(1) Disable SIP

(2) Restart and run the command (with the appropriate values for teamId and bundleId):

systemextensionsctl uninstall <teamId> <bundleId>

(3) Reenable SIP

Is this still recommended?

Accepted Answer

Reviewing some of my old notes and searching online, the best answer I can come up with is:

(1) Disable SIP

(2) Restart and run the command (with the appropriate values for teamId and bundleId):

systemextensionsctl uninstall <teamId> <bundleId>

(3) Reenable SIP

Is this still recommended?

the best answer I can come up with is

That seems reasonable enough.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Unable to delete endpoint and network system extensions
 
 
Q