Unable to uninstall 'EndpointSecurityforMac'

darnyill-za wrote:

It's in a folder called 'ManagedAntivirus'

How "Managed" is it? Did you enrol your computer in their MDM? If so, you don't own the computer anymore. No one should ever BYOD for work. There's too much risk of this kind of problem.

I'm not familiar with MDMs. Check your profiles and see if you still have a profile from them. You might need to contact IT and ask for help.

Most importantly, make a backup of your computer. In theory, it is possible to unenrol a computer from an MDM. But I think that's just theoretical. I don't think it is really possible.

A guaranteed fix/failure test is to erase the hard drive and reinstall the operating system. If it comes up with an MDM lock, then you're off to the store to buy a new computer. And be careful about the restore. I recommend restoring only your user files and user accounts. Do not restore any apps, system settings, or "other files". This is a worst-case scenario. Hopefully it won't come to that. But be prepared.

darnyill-za wrote:

This should be something their IT dept could potentially undo though right??

In theory, yes. But I've seen many reports about MDM associations being permanent, even when no one wants them to be.

alternatively do you think a Time Machine rollback would be effective? I’ll copy any files and folders onto a separate hard drive before

You just need to keep trying, taking increasingly drastic measures.

First, examine all of your launchd daemons and agents. This could be something as simple as an MDM (Jamf, Mosyle, etc.) daemon reinstalling the antivirus automatically. You'll need to remove all of that.

Next (at the same time, really), look for any MDM profiles and remove them, if possible.

If the above doesn't work, erase the computer and reinstall the operating system. This is where you could get an MDM lock and you become a proud brick owner. If not, you can try the partial restore I described before.

Your Mac is still being administered.

If it’s “managed”, removing any added MDMs might work, but folks running endpoint security will usually have Jamf or some other similar remote management app loaded and that’ll usually also have to be disabled and removed. And I’d suspect it’s Jamf or some equivalent tool that’s reloading the endpoint security here.

If it’s “supervised”, the folks holding the supervisory lock will need to remove that.

At the risk of what may be an obvious question, y’all have tried the uninstaller?

https://www.bitdefender.com/business/support/en/77209-80124-using-the-uninstall-tool-to-remove-bitdefender-endpoint-security-tools.html

Need help uninstalling Symantec Endpoint … - Apple Community