Uninstalling SentinelOne MAC Agent through Recovery Mode
03/26/2020 
14 
12537
DESCRIPTION:
This article talks about Uninstalling SentinelOne Mac Agent through Recovery Mode.
RESOLUTION:
Uninstalling the Mac agent through recovery mode:-
If you upgrade to a macOS version that is not supported with your SentinelOne macOS Agent version, your endpoint might experience kernel panic.
To avoid kernel panic, check the System Requirements for macOS Agents before you upgrade your OS and install all available software updates. In most cases, upgrading software prevents kernel panic.
Symptoms of Kernel Panic
A message shows that your computer was restarted: "Your computer restarted because of a problem." After a moment, the computer continues to restart.
The computer spontaneously restarts.
A message shows: "You shut down your computer because of a problem."
Use the guidelines provided by Apple to diagnose the cause of kernel panic.
To diagnose SentinelOne as the cause of kernel panic:
Rule out hardware or other software options.
See if the kernel panic logs show SentinelOne information.
The kernel panic text is added to the log after you restart the computer, if you did not reset PRAM (the kernel panic text is stored in PRAM until you restart). In Mac OS X v10.6 or later, the logs are located in /Library/Logs/DiagnosticReports.
If an incompatible SentinelOne Agent is the cause of the kernel panic, use the macOS Recovery Mode to unlock the encrypted APFS volume and uninstall the Agent.
To uninstall the incompatible Agent with macOS Recovery Mode:
Hold down the Command and R keys during system start to boot into macOS Recovery Mode.
Newer Mac computers and some older Mac computers automatically try to start up from macOS Recovery over the Internet, when unable to start up from the built-in recovery system. If this occurs, you see a spinning globe instead of an Apple logo during startup. To manually start up from macOS Recovery over the Internet, hold down Option-Command-Ror Shift-Option-Command-R at startup.
Choose the language, as usual (if applicable).
From the macOS Utilities window, open the Utilities menu from the toolbar.
Select Terminal to launch the Terminal app within Recovery Mode.
Identify the relevant encrypted APFS volume: # diskutil apfs list
For older HFS file systems, use the diskutil list equivalent.
Unlock the encrypted APFS volume: # diskutil apfs unlockVolume /dev/<apfs_volume_id_here> [-<passphrase recovery_key_goes_here>]
This assumes you have access to the personal recovery key associated with the encrypted APFS volume. If you do not have access to this, use a different option to unlock or decrypt an encrypted APFS boot drive.
Uninstall the Agent:
Run: # cd /Volumes/{<apfs_volume_name_goes_here>}/Library/Sentinel
Launch sentinelctl: sentinel-agent.bundle/Contents/MacOS/sentinelctl
Uninstall the Agent: uninstall --local
Restart the computer.
Install a compatible Agent version.
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Capture Security applianceAdvanced Threat Protection for modern threat landscape
Network Security ManagerModern Security Management for today’s security landscape
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
Email SecurityProtect against today’s advanced email threats
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
