McAfee system extensions are not removed after pushing an upgrade from ePO and rebooting

Technical Articles ID: KB96551
Last Modified: 5/31/2023

Environment

Endpoint Security for Mac (ENSM) 10.7.9

Problem

After you push an upgrade from ePO and reboot, you see that the McAfee system extensions are not removed. These extensions constantly crash.

If you enable device logging, device.log contains the following error before the product upgrade flow:

sysextd deactivation request for com.mcafee.CMF.networkextension failed authorization check, error:
Error Domain=OSSystemExtensionErrorDomain Code=13 "(null)"

Cause

In a non-MDM environment, the user is prompted to approve the removal of the system extensions. This prompt is displayed for 60 seconds. If user consent is not provided by entering the password, the original system extension is not removed. You will then have two system extensions running. After a reboot, the system extension signed by McAfee, Inc will repeatedly crash.

Solution

Trellix is currently investigating this issue.

If you already have this issue, open a case with technical support who can perform a remote session to assist in removing the System Extensions from the client.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

McAfee system extensions are not removed after pushing an upgrade from ePO and rebooting

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

McAfee system extensions are not removed after pushing an upgrade from ePO and rebooting

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title