Capture Client macOS Agent Upgrade Playback - Ventura

This article explains about capture client compatibility with macOS Ventura 

Latest Information - Last Updated on 05th Dec 2022

Introduced at WWDC 2022, macOS Ventura is the current version of macOS, the operating system that runs on the Mac. macOS Ventura is a significant update that introduces a new multitasking experience, overhauls multiple Apps, and adds updated capabilities across the platform.

SentinelOne has released an article detailing the changes that are introduced to macOS Ventura and what it means for SentinelOne endpoint agent. See here. 

General Supportability and guidance on macOS Support

In general, admins are advised to refer to this table to identify if a compatible Capture Client and/or SentinelOne version is available to support the macOS version they are looking to upgrade to (before they make the upgrade).

Follow the steps in the flowchart below to avoid compatibility issues. 

Upgrade the Capture client and SentinelOne macOS Agent version before upgrading the OS to Ventura:

1. When a new macOS upgrade is available to version Ventura (13.x), Do not upgrade the endpoint until you have a supported SentinelOneAgent.
2. Upgrade the operating system:
   •      If the endpoint is on macOS Monterey, Big Sr or Catalina (10.15.7), go to the next step.
   •      If the endpoint is on a lower OS, upgrade to Catalina (10.15.7).
3. Upgrade the Capture client and SentinelOnemacOS Agent.
   •       If the endpoint has Capture client Agent version 3.6.* and SentinelOne Agentversion 4.3, upgrade the OS to macOS Catalina, Big Sr or Monterey with Capture client Agent version 3.7.5 or later and SentinelOne Agent version 22.2 GA or later.
   •       If the endpoint has Capture client Agent version 3.6.* and SentinelOne Agentversion 21.7 GA or earlier installed, upgrade to Capture client Agent version 3.7.5 or later and SentinelOne Agent version 22.2 GA or later.
   •       If the endpoint has Capture client Agent version 3.6.* and SentinelOne Agentversion 21.7.4 or later installed, upgrade to Capture client Agent version 3.7.5 or later and SentinelOne Agent version 22.2 GA or later.
   •       If the endpoint has Capture client Agent version 3.6.* and SentinelOne Agentversion 22.1 GA installed, upgrade to Capture client Agent version 3.7.5 or later and SentinelOne Agent version 22.2 GA or later.

 Repairing an Endpoint that upgrades to an incompatible macOS version

If the macOS of an endpoint is upgraded before the SentinelOne Agent that supports the target version is available, the endpoint may experience unexpected behavior.

• Roll back the OS upgrade to a working state (https://beta.apple.com/Sp/betaprogram/restore).  OR 
• If that cannot be done, Uninstall the capture client completely. 

How to Uninstall Capture Client and SentinelOne:

• Uninstall the Agent through the Management Console.
• If that does not work, Uninstall the Agent locally. Run: sudo sentinelctl Uninstall and enter the passphrase.
• If that does not work, run these steps:

• Disable anti-tampering in the policy for the Agent OR manually disable anti-tampering: sudo sentinelctl unprotect
• Delete our ext: sudo rm -R /Library/Extensions/Sentinel.ext. This disables protection to let us Uninstall.
• Reboot.
• Uninstall the Agent (through the console or with sentinelctl Uninstall).