macOS 26.3 boot failure – recovery path validation (Configurator + Time Machine)

[TomJung2025]

Hi there,

we are currently affected by the macOS 26.3 boot failure described in SK184676.

Context:

• Impacted users upgraded from macOS 26.2 to 26.3

• Systems fail to boot after the upgrade

• Check Point Endpoint Security versions prior to E89.xx are installed on the affected Macs

Reference:
https://support.checkpoint.com/results/sk/sk184676 

Question:
To recover affected devices, can you please confirm whether the following rollback approach is supported and safe:

1. Reinstall macOS 26.2 using Apple Configurator 2, including a firmware rollback if required.

2. After reinstalling macOS 26.2, restore the system using a Time Machine backup taken prior to the macOS 26.3 upgrade.

Specifically, we would like to know:

• Is this recovery path supported by Check Point?

• Are there any known issues or additional cleanup steps required related to Check Point Endpoint components before or after the Time Machine restore?

Thank you for your confirmation and any best-practice guidance you can share.
T.Jung

[_Val_]

The supported recovery pass is actually outlined in SK184676. 

What you are proposing, in personal my view, is overkill. It may most probably work, but I would stick to what SK suggests.

[TomJung2025]

Thank you @_Val_ - so far PCs and Macs are running EP88.70 / 88.72. under these conditions - can the SK suggested recovery pass still being implemented? Thank you.

[_Val_]

Windows are not affected.

For Macs, note that Tahoe OS is not supported with E88.7x at all. You either run an older OS or an unsupported configuration. In either way, if you have issues with that, open a TAC case, as I already suggested.

[TomJung2025]

Hi @_Val_ 

followed https://support.checkpoint.com/results/sk/sk184676

1st discovery: with MacOS 26.3 installed Volumes are slightly different:

• no FileVault used, and is Data mounted
• /Volumes/Macintosh HD/
• /Volumes/Data/
  no /Volumes/Macintosh HD - Data/
• the 5 files in question are in /Volumes/Data/Library/LaunchDaemons

com.cp.efr.agent.plist
com.cp.te.agent.plist
com.cp.ar.agent.plist
com.checkpoint.efr-mon-epsec.plist
com.checkpoint.threat-hunting.plist

• deleting them does _not_ will make the Mac boot
• there are other Checkpoint related launchdeamons in that directory:

com.checkpoint.anti-bot.agent.plist
com.checkpoint.cpacApp-plist
com.checkpoint.cpamdApp.plist
com.checkpoint.cpcmpld.plist
com.checkpoint.cpdaApp.plist
com.checkpoint.cpfwd.plist
com.checkpoint.epc.service.plist

any ideas?

[TomJung2025]

Hello there,

• updated from 26.2 to 26.3 with EP 88.7x installed
• boot failure
• reinstalled macOS 26.3 via as recovery mode (all data kept) since we thought something went wrong during update
• Boot failure, than learned about 26.3 issue

followed https://support.checkpoint.com/results/sk/sk184676

1st discovery: with MacOS 26.3 installed Volumes are slightly different:

• (no FileVault used, so Data is mounted)
• /Volumes/Macintosh HD/
• /Volumes/Data/
  no /Volumes/Macintosh HD - Data/
• the 5 files in question are in /Volumes/Data/Library/LaunchDaemons

com.cp.efr.agent.plist
com.cp.te.agent.plist
com.cp.ar.agent.plist
com.checkpoint.efr-mon-epsec.plist
com.checkpoint.threat-hunting.plist

• deleting them does _not_ make the Mac boot
• seems to be still stucks at same stage during boot process
• there are other Checkpoint related launchdeamons in that directory:

com.checkpoint.anti-bot.agent.plist
com.checkpoint.cpacApp-plist
com.checkpoint.cpamdApp.plist
com.checkpoint.cpcmpld.plist
com.checkpoint.cpdaApp.plist
com.checkpoint.cpfwd.plist
com.checkpoint.epc.service.plist

any ideas how to proceed?

thank you community. 
T. Jung

[_Val_]

@TomJung2025, please note I merged your second post here, as there is no point in creating multiple discussions for the same topic. 

As already said, E88.xx is not even supported with any of the Tahoe versions you are running. Please reach to TAC and ask for guidance.