System Extension Blocked - but can't allow extension

Good morning Rob,

I have upgraded my VMWare Fusion to 10.1, and created a new VM with a fresh install of OS X 10.13, and I did receive the message re: Extensions you are posting about after installing VMWare tools. However the alert was generated by the guest OS inside VMWare Fusion and not the Host OS. I went into System Preferences / Security on the guest OS and the extension was listed to allow.

What version of VMWare Fusion are you running?

What guest OS are your running inside VMWare Fusion

Is your version of VMWare Fusion up to date?

After updating VMWare fusion, is the version of VMWare Tools up to date on your GuestOS?

Have you contacted VMWare support?

Okay, little update on my situation for your benefit and time savings 😝

So, my Time Machine back-ups haven't worked since I installed High Sierra, so I made a new 1TB back-up on a USB disk, that took a good 10 hours but worked fine. Then I restored my iMac from that same back-up. I wasn't expecting this to solve my problem, but the Apple Tech suggested it for if I had the time and was curious what there results would be, so why not?

The iMac restored overnight and I just woke up to an iMac that was exactly the same as it was yesterday, still not able to allow system extensions in 'Privacy and Security'. So that was a waste of time. But hey, new datapoint.

My Time Capsule has back-ups going back a few years, with the most recent being about an hour before installing High Sierra. So at the moment I'm restoring that back-up. If my research is correct, restoring this should give me back Sierra on the machine, not High Sierra. So this should basically (temporarily) solve the issue. When This back-up is restored (estimate is 33 hours to go :/ ), I can reinstall High Sierra and see what happens. If that solves it, yay. If I get the same issues again, the only option left is the nuclear one. Clean install and pluck all my files from the new Time Machine Back-up I made yesterday.

So my findings so far:

- A clean install on a separate drive has no issues

- Restoring a Time Machine back-up from after the issue arose does not solve the issue

Next options:

- Restore a Time Machine Back-up from before High Sierra was installed and update it to High Sierra

- Clean install and copy all my files from the most recent Time Machine Back-up.

Here is another update for you guys.

I restored the week old Time Machine Back-up, from before High Sierra was installed, that resulted in a perfectly working machine, but with outdated data. After making sure everything worked as it should, I went to the App Store and downloaded High Sierra again and installed it. First thing I tried was installing the drivers again, and three guesses what happened. System Extension was Blocked, no Allow button, back to square #1. Played around with it a bit and it was exactly the same, not only the extension problem, but Time Machine couldn't connect to my Time Capsule and DMGs started making Finder Crash again.

So I was left with the last option, a clean install 😢

Which is what I did, I made a bootable USB drive on my MacBook, since that didn't work on my iMac, it kept crashing on downloading the installer or putting it to USB. So MacBook to the rescue. I rebooted the iMac into recovery, wiped the Fusion drive and installed MacOS from the USB disk. Which resulted in a perfectly smooth and operational MacOS High Sierra installation. First thing I did was get my drivers, installed them, got the System Extension Blocked message, headed to Security and Privacy and lo and behold, there was an Allow button! I clicked it, rebooted my machine like the installer wanted and my 3D mouse worked like a charm 🙂

Messed around with DMGs a bit, seemed to work fine, so I connected the USB drive with my latest Back-up (after HS install) and started putting all my files back manually, luckily that's an easy process since you just get your file structure in the back-up, so it's just a matter of dragging and dropping files back to where they should go.

Again, it's 1TB so that took hours, but hey, I had everything back in working condition 🙂

Until last night. I was mostly done putting everything back, my files are back on there, the smaller apps were moved or redownloaded, just had a few more to go when I noticed an MacOS update on my macbook. So I headed over to the App Store on the iMac, no update. Clicked the tab again "Error, could not connect..." Euhm... Opened Safari... back screen. Restarted Safari, black screen. No sites opened. Opened Chrome, no issues, worked fine.

Mail worked, Photo's didn't sync. iTunes Store works fine, Maps works, App Store browsing works, just not updates or actually downloading apps. And Safari does absolutely nothing. Page starts to load, blue bar starts running, stops. Page stays white, no error's noting, just stay like that.

I made a new test user account, and there everything works fine, so something in my user seems messed up, but I did nothing that could have messed it up. I moved some files, installed some often used and trusted apps. How the heck did that mess up Safari from working and some Apple Apps from connecting?

So I "fixed" my original problem by nuking it. But then a new issue posed up. I'm reinstalling MacOS over it again, which will 99% not do anything, but hey, it's worth a try before I call Apple again. I'm getting really tired of this. I haven't been able to use my iMac in over a week now :/

So to everyone with the "System extension blocked" issue, it seems like a clean install is the only way to "fix" it. I hope no one else encounters other issues along the way, though.

Thank you for your thorough update. I wLund up starting from scratch and doing a clean install and it solved my problems. I had to do a lot manually after that since I did not have a proper back up to restore from (I had a clone of my drive but since it was on beta 10.13.1 and my main machine which was on 10.13, they couldn’t properly talk to each other in order to do a restore). I think I like having a clean system anyway, and I was able to eliminate all the crud that built up over the years. I lost Photoshop CS5 in the process, but I don’t think I’ll miss it too much. I still have to work on getting my photos organized and back up on my main machine, but overall I’m very happy where I am now. In all my years and all my updates, this is the first time I ever needed to do a clean install and now I know firsthand the advantages. Best of luck to everyone!

Okay, last update from my journey. Like I expected, installing High Sierra over the second buggy one did nothing, it was just a waste of an hour. So I went nuclear again. Erased the disc, did a clean install and took my time putting my apps and data back this time. No sense spending a day just copying stuff if I have to redo it all again the day after. So I took my time, grabbed the most used things from the App Store, put vital data back and started working on the machine like normal. Put stuff back when I needed it or when I had some spare time. At this point everything is back where it belongs, all my apps are here, et and everything works fine. No issues whatsoever (just the media keys on the keyboard that are not fixed to iTunes anymore but switch over to whatever app they want :/ ).

So I'm not sure what happened with my first clean install, but the second fixed everything. That second install was done with the same bootable USB drive, not an updated one, so your guess is as good as mine as to why things went haywire again.

But at least I'm back to business as usual 🙂 It took me over a week, and I have a clean system now (which to be fair might not be such a bad thing after a decade of updates).

So for anyone else with this problem, unfortunately it seems like a clean install is your only option 😟

Hi, there is a fast solution for this "allow button problem" and is that you can disable the allow kernel extension mess.

You should boot your OsX in Recovery Mode (Restart, and press Command R)

When you are in Recovery Mode, go to the menu bar and open a Terminal and run the next command:

$spctl kext-consent disable

Then reboot the OsX normally. All the mess are gone and all the kext are loaded as usual.

Reseting the NVRAM will revert this changes!

😀

My migration failed due to an old driver (Silicon Image 3132 PCIe eSATA card), resulting in a disturbing reboot loop until I turned off my external disk.

That installation interruption, I think, resulted in a corrupted Kernel Extension db. At least, sqlite3 didn't like the file very much. When you list the tables in that file, what's SUPPOSED to happen is this:

$ echo .tables | sqlite3 /private/var/db/SystemPolicyConfiguration/KextPolicy

kext_load_history_v3 kext_policy

I got the error: "database disk image is malformed"

I was able to fix this by booting into Recovery mode (cmd-R when the system comes up), moving the KextPolicy db out of the way in the Terminal app, and re-installing High Sierra.

Details: Once the system was up in recovery mode, I fired up the Terminal app (under "Utilities") and did this:

# cd /Volumes/System\ Drive/private/var/db/SystemPolicyConfiguration

# mv KextPolicy /Users/Shared

# mv migration.plist /Users/Shared

(Note: your system drive might be named something other than "System Drive". Also, I just wanted to make a backup of the files someplace where the installation process won't clobber them.)

I then quit the Terminal app and just re-installed High Sierra. 55 minutes later (or there abouts) I was able to list the tables in the KextPolicy db AND, best of all, VMWare fusion worked and no other Kext complaints were in evidence.

You can search the Internet for things like "SystemPolicyConfiguration" or "sqlite3 'database disk image is malformed'" to get a bunch of background info about this.

But, that said, I'll probably spend some part of my Christmas long weekend reinstalling this guy from scratch.

We had a similar issue here.

Our mac was controlled via "Screen Sharing". The popup that the "Allow" or "Allow..." button is meant to start doesn't appear when the button is pressed over Screen Sharing. Plugging in a hardware mouse and monitor allowed us to open the pop up sheet and allow the extensions. I have reported this bug RADR 35666776.

I managed to fix this issue. You'll have to disable SIP to let the Kext load without any interference.

Steps to disable SIP:

1. Boot into recovery mode (Hold CMD + R during booting process).

2. Open terminal and enter the following command: csrutil disable

3. Reboot the system. This should allow the kernel extensions to load without any interference.

(Re-enable SIP using csrutil enable)

This is clearly not the safest way to fix this, but it worked for me. I wasted many weeks because of this issue. It's truly sad that macOS has become less developer-friendly over the years.

Hello,

I have the same problem with vmware and paragon at job today. After lot of search eventually could fix with a NVRAM reset.Not at job before 10hours so if somebody could try and give feedback, that could be cool.

Ty

I have been having an issue installing an Antivirus package. The Allow button was showing but clicking on it wouldnt work. To fix the problem I created a new administrators user account and have now been able to "allow" the application in Security & Privacy from within that account. I am no expert but am wondering if the existing profile now has some conflict since upgrading to High Sierra.

Well, you can also consent to the specific extension(s) from recovery mode, but you need to know the team ID. The solution comes courtesy of Parallels (http://kb.parallels.com/124289) but should work for anyone, who is willing to give you the team ID.

Wow... thanks for the tip to about the screen sharing. Once I logged in directly I could click "allow". It seems Apple was smart enough to not accept screen sharing clicks on "Allow" ( which maybe is good for protection against remote attacks ) but not smart enough to gray the button or reroute it to a pop up that explains you can't do this.

I was wondering why I couldn't press "Allow" on my new iMac Pro and thought it had to do with special security on that machine, but it was just this issue. The error message in the console app whenever I tried to press allow via screen sharing was, "dcom.apple.preference.security.remoteservice Dropping mouse down event because sender's PID isn't 0 or self". In person there was no problem. A popup notification would have been helpful!

I had the same issue but was able to resolve it after logging in as the primary admin user (You may not have one, try to create a second admin user if you don't). As my user, the popup dialog that is created after clicking allow was not coming up. My guess is that the system thinks I don't have rights to all the extensions that I was trying to install. Hope it works for everyone.