All System Extensions missing from Preferences pane

Hi,

after a faulty deployment of Kaspersky thru a MDM, we have plenty Mac that have no more System Extensions in the preference pane: it's empty. Therefore, all functions attached to these are missing like share via mail, etc… Furthermore, it's the same situation for Safari: no more Extensions available…

Reinstalling a system over does not repair the situation. All accounts on an affected computer are affected…The affected systems are 10.15 and 10.14 at least…

The problem is mainly that we have absolutely no idea what goes wrong as we are not the initiators of the installation (some IT people apply badly the deploy to our site).

Any idea will be welcome before clean install that appears as the ultimate solution…

MacBook Pro 16″, macOS 10.15

Posted on Feb 19, 2021 7:43 AM

Reply
Question marked as Top-ranking reply

Posted on Feb 22, 2021 5:30 AM

And we got a miracle!

After analysing a new installation on a clean Mac, we have seen that the culprit file was pushed here:

/private/var/db/ConfigurationProfiles/Settings/com.apple.managed.PlugInKit.plist


the removal of this file gives us a full restoration of extensions in System and Safari :-)


Now, we will see if we can automate removal thru MDM, otherwise "by hand" it's not so easy:

— reboot command-R

— disabling SIP (csrutil disable)

— normal reboot

— sudo mount -uw / to allow read/write in system partition

— sudo rm /private/var/db/ConfigurationProfiles/Settings/com.apple.managed.PlugInKit.plist

— normal reboot


Et voilà! But SIP is still disabled at this stage…


17 replies
Question marked as Top-ranking reply

Feb 22, 2021 5:30 AM in response to a brody

And we got a miracle!

After analysing a new installation on a clean Mac, we have seen that the culprit file was pushed here:

/private/var/db/ConfigurationProfiles/Settings/com.apple.managed.PlugInKit.plist


the removal of this file gives us a full restoration of extensions in System and Safari :-)


Now, we will see if we can automate removal thru MDM, otherwise "by hand" it's not so easy:

— reboot command-R

— disabling SIP (csrutil disable)

— normal reboot

— sudo mount -uw / to allow read/write in system partition

— sudo rm /private/var/db/ConfigurationProfiles/Settings/com.apple.managed.PlugInKit.plist

— normal reboot


Et voilà! But SIP is still disabled at this stage…


Feb 20, 2021 8:40 AM in response to jean-Luc Evrard

We can likely tell what to remove from affected Macs using Etrecheck...


EtreCheck is a FREE simple little diagnostic tool to display the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to help people help you with your Mac. It will not display any personal info.

https://www.etrecheck.com/


Pastebin is a good place to paste the whole report if you capture the URL while there…

https://pastebin.com/

Whew, they've changed pastebin & made it harder, but after pasting in, click Create new paste button, then Embed button, then copy the URL...

<script src="https://pastebin.com/embed_js/KuvnghqA"></script>


The important part of the above is...


https://pastebin.com/embed_js/KuvnghqA


Workable but harder for me to work with...the Note tool on the bottom of this editor's toolbar, as shown in the image, to copy and paste the output from EtreCheck. In a Reply before you click post, look for this to add longer texts...

Feb 21, 2021 7:22 AM in response to jean-Luc Evrard

Quite perplexing, even moreso from afar!?


See if you have unknown Profiles.

To remove a configuration profile in macOS:

  1. From the Apple menu, select System Preferences....
  2. From the View menu in System Preferences, select Profiles.Note:
  3. Profiles won't be visible until you have at least one profile installed.
  4. Select the profile you want to remove, and then press the - (minus) button. Click Remove to remove the profile.


Feb 19, 2021 10:57 AM in response to jean-Luc Evrard

Yes, since you've already tried reinstalling the OS over the what's currently on the drive and standard OS functions still don't work, then I'm afraid you're at an erase and rebuild.


To stress this part again: If you don't have a backup, make absolutely sure to create one before doing anything else. You'll need some way to restore your email and other personal data.


When you have a backup in place, restart the Mac and hold down the Command+R keys to boot to the hidden recovery partition. From there you can run Disk Utility to erase the drive, then reinstall the OS.


If you have a Time Machine backup that was made BEFORE installing Kaspersky, you can merge it in. Personally, I never use TM so I can't tell you exactly how that works.


When you do have your Mac in a functional state, never, never, ever install such garbage again. There are no Mac viruses. No AV software will do anything to stop you from installing the many Trojans out there. If you get any Windows malware as an email attachment or download, they can't do anything to the Mac OS. In short, AV software is useless.

Feb 21, 2021 11:19 AM in response to jean-Luc Evrard

Clone backup your system before any diagnostics are done.


Etrecheck is really good at isolating LaunchDaemons that don't belong.


Zeobit, MacPaw software should be removed in safe mode with the shift key using Devon Technologies EasyFind

Show in Finder on each suspicious file.

And anything else you don't recognize from your Etrecheck report.


No cleaner software should be installed, no keeper software.

They are all attempts at luring unsuspecting new Mac users into installing software that is at best overzealous in its protection, at worse, it creates a headache for launching applications and slowness.


Once Malwarebytes is run, and Avast, you should not need Kaspersky or any other virus cleaner software except when machines start misbehaving again. The best protection is training every team member to learn signs of social engineering before they touch a computer.


I offer paid consultation through my profile.

Feb 21, 2021 12:28 AM in response to BDAqua

Hi,

I have tried Etrecheck and analysed the report. There is nothing special and no more traces of Kaspersky extensions or daemons. Interestingly, as I have observed using other ways, Safari extensions are presents but, as told, Safari sees none…

We suppose that Apple pkd or pbs processes are affected but why and from where, that's a mystery…

Anyway, thank you all for ideas…

Feb 22, 2021 2:10 PM in response to jean-Luc Evrard

I did a full drive search of both Catalina and Big Sur. There is no such .plist item.


So, the question is - what put it there to begin with? Kaspersky?


I was going to download the installer for Kaspersky and use a utility on it that shows you where all of a package installer files go. But, all you get from Kaspersky is a stub item that downloads and installs the app from their servers on the fly. No way was I going to do that to my Mac.


There's also nothing on the web that's an exact match for that .plist name.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

All System Extensions missing from Preferences pane

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.