topic Re: Endpoint on Mac: Uninstalling the E85.30 ME blade in Endpoint

Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Tue, 22 Feb 2022 11:02:15 GMT

Hi,

We have a user who has problem accessing USB devices on their Mac that is running E85.30.

I exported a new package from the server that was the same version, but had the ME blade unticked at export. When this was installed, which finished without error, I noticed in the console that the ME blade's status was "Off", and a plugged in memory stick could be read.

We rebooted the laptop, expecting the ME blade to be removed entirely from the console, but instead it was still there, and active.

I had no luck finding anything about this on the support site, and not much here either. I did find in the installation folder a number of scripts, including one called "uninstall_ME.sh", however this just generates errors when it is run.

Is there another process to call this script? The fall back would be to remove the entirety of Endpoint, including Filevault, then re-install the newly exported package with ME missing, but I was hoping to avoid that.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Chris_Atkinson — Tue, 22 Feb 2022 13:16:18 GMT

Have you considered testing E86.20 here?

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Tue, 22 Feb 2022 14:32:29 GMT

I hadn't. But I would if it allowed for the selective adding/removing of blades as the Windows version does, even if it is locally driven rather than from the Endpoint server.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

the_rock — Tue, 22 Feb 2022 14:37:47 GMT

Just curious...what is exact error when you run that script? Have you tried running it with sudo flag?

Andy

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Chris_Atkinson — Tue, 22 Feb 2022 14:39:44 GMT

R81.10 introduced deployment rules support for MacOS clients but I've not tested the granularity of the same.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Tue, 22 Feb 2022 15:13:55 GMT

Yes, and as root, though I didn't actually think that would make a difference.

There isn't any one error if I remember right, but about two screens worth of individual files reporting "operation not permitted" or similar. I suspect it was trying to delete the files, and didn't have the rights to do so, as if an active process was protecting them. Perhaps trying it in Safe Mode would be one thing to try?

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

the_rock — Tue, 22 Feb 2022 15:16:17 GMT

Actually yes! Thats excellent suggestion...did not think of that, but I am positive it would work. Let us know if you can try that.

Andy

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Tue, 22 Feb 2022 17:26:41 GMT

The colleague with the laptop in question will be back in the office on Thursday, so I hope to give Safe Mode a go then. I will report back.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

the_rock — Tue, 22 Feb 2022 17:57:19 GMT

Im not nearly as Mac expert as @PhoneBoy , but I guess the fact I had old grape mac desktop qualifies me for something : - ). Not sure if below link might help in your situation?

http://www.macosxtips.co.uk/index_files/tips-for-deleting-stubborn-files.php#:~:text=To%20delete%20a%20file%20using,to%20that%20item%20should%20appear.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

PhoneBoy — Tue, 22 Feb 2022 20:27:11 GMT

Your best bet is to uninstall the fill Endpoint client and try again.
I suspect the reason you can't delete the files in question is the self-protection mechanisms built into the product.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Wed, 23 Feb 2022 09:25:07 GMT

I fear you may be right. Any idea what those various "uninstall_<blade>.sh" scripts might be for in that case? I know if I run the "uninstall.sh" script it will remove the entire product, after first triggering decrypt, so I assume there is a way to do this selectively.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Wed, 23 Feb 2022 09:26:07 GMT

I think forcibly deleting files out from under Endpoint might be a bad thing to do.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

the_rock — Wed, 23 Feb 2022 13:31:31 GMT

I get your point...might be a bit risky, thats true, but at least probably better than removing the whole thing.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

PhoneBoy — Wed, 23 Feb 2022 15:38:52 GMT

I assume those install_<blade>.sh scripts are meant to be called from the larger uninstall.sh script.
Perhaps there's a way to selectively trigger it, but offhand, I don't know if that's possible.
Might be worth a TAC case.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

jcortez — Mon, 07 Mar 2022 15:20:50 GMT

@Howard_Gyton

It is not possible to handle individual blades installations offline like you can do with Windows. The only option you have for our macOS clients is the full exported package or Software Deployment rules. We are limited to just these options because of Apple's architecture and them limiting what 3rd Party Security products can do on their systems and OS since they like to control what software does.

If there is a suspicion with the Self Protection with our macOS client then I would suggest trying this SK.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171012&partition=Basic&product=Endpoint

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Mon, 07 Mar 2022 15:25:16 GMT

I know it doesn't work like the PC. I did use an exported package that had everything minus the ME blade, and installed that over the top, hoping that it would remove the ME blade, but it didn't.

During the install I could see that the ME blade's status changed to something like Inactive(?), but after a reboot the ME blade was running again.

I'm sure I've used that process to add a blade, but is it possible to remove them also? If not it seems a pretty weak solution to have to do a full de-install, and decrypt, just to add one blade.

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

jcortez — Mon, 07 Mar 2022 15:43:47 GMT

@Howard_Gyton

No, the method of installing a different package with the blade(s) not included on top of what is already installed will not work. The same will not work on Windows installations without using the msiexec cli cmd and providing the blade mask.

Again if you want to remove and or add blades on macOS clients without having to uninstall and reinstall the client you will have to use Software Deployment Rules. This is only supported in GA though since E86.20 macOS client and your Endpoint Server version would need to be R81.10.

Enterprise Endpoint Security E86.20 macOS Client

Re: Endpoint on Mac: Uninstalling the E85.30 ME blade

Howard_Gyton — Mon, 07 Mar 2022 15:44:04 GMT

Great, thanks for the clarification. We are pushing E62.20, but still have an R80.30 server. I'll look to upgrade to R81.10 in that case.