Issue
When trying to reinstall the sensor on a new macOS endpoint the installer fails with the following errors:
Post install logs errors:
03/22/22 13:29:59 [ERROR] 2494cb failed to uninstall system extension
03/22/22 13:29:59 [INFO] 2494cb program terminated with error code: 4096
Note: To generate the logs during installation use the command line commands to install the sensor.
Windows Command Line Install on Endpoints — Examples
Environment
VMware Carbon Black Cloud
macOS
Resolution
To resolve the issue please follow the following steps:
1. Verify that a system extension for Carbon Black is active:
sudo Systemextensionsctl list
2. If a system extension is present for com.vmware.carbonblack.cloud.se-agent.extension, move to step 3 otherwise proceed to step 7.
3. Disable System Integrity Protection (SIP) from recovery mode to allow the system extension to be removed. Refer to Disabling and enabling system integrity protection for the steps.
4. Once you have disabled SIP reboot to normal mode and sign in.
5. Check if the system extension for com.vmware.carbonblack.cloud.se-agent.extension is still active:
sudo Systemextensionsctl list | grep carbonblack
6. Manually uninstall the system extension from the device:
sudo systemextensionsctl uninstall <enter your company code here> com.vmware.carbonblack.cloud.se-agent.extension
Note: your company code or installation code does not need <>.
7. Verify that the system extension is disabled and waiting for a reboot:
sudo Systemextensionsctl list | grep carbonblack
8. Reboot the device.
9. Run the Sensor installer, the sensor should install without any other issues. If you encounter any problems please open a support ticket with Red Canary.
10. Re-enable the System Integrity Protection (SIP) by following the steps from Disabling and enabling system integrity protection
Reference: Carbon Black Cloud: Unable to upgrade or install due to existing system extension (macOS)
Cause
Previous system extension is still active in the environment.