000031621 - How to remove the RSA ECAT 4.x Agent from an Apple Mac OS X system

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support on Mar 7, 2019
Version 6Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000031621
Applies ToRSA Product Set: ECAT
RSA Product/Service Type: ECAT Agent
RSA Version/Condition: 4.4.x
Platform: Mac OS X
IssueHow to uninstall the ECAT Agent from an Apple Mac OS X?
TasksIt may become necessary to remove the ECAT Agent software from a users Apple Mac OS X system.
ResolutionUnder normal circumstances to uninstall the Mac ECAT Agent software, please refer to the ECAT User Guide, available on the RSA SecurCare Online (SCOL) website.

See the section on "Uninstall Agents and Remove Agents from the Database". This section describes how to uninstall from the UI.
  1. In the ECAT Server UI, Machines
  2. Right-click the Mac you want to uninstall the Agent software from, and select Agent Maintenance -> Uninstall Agent.

User-added image


Note the Mac must be Online in the ECAT Server UI for this to work.

Also note the information collected from this Mac machine doesn't get deleted from the ECAT Server after the Agent software is uninstalled, that is an additional manual action should you wish the data to be deleted (see the ECAT User Guide).

Manually uninstall an RSA ECAT Agent from a Apple Mac

In order to manually uninstall an RSA ECAT Agent from a Apple Mac, follow the steps below:

  1. Create the following shell script file: mac_agent_uninstall.sh
  2. Include the following commands in the script file:

    #!/bin/bash

    launchctl unload /Library/LaunchDaemons/com.rsa.ecat.agent.daemon.plist
    rm -Rf /sbin/ECATAgent
    rm -Rf '/Library/Application Support/ECAT'
    rm -Rf /Library/LaunchDaemons/com.rsa.ecat.agent.daemon.plist

  3. Copy the script file onto the Mac machine, give it execute permission, and run it with sudo in terminal.


cd {directory_where_script_is_located}
chmod +x mac_agent_uninstall.sh
sudo ./mac_agent_uninstall.sh


By entering sudo, you are requesting to run the script as a super user, which requires entering the Mac’s login password.

No restart of the system is required.

Attachments

    Outcomes