Installing and Uninstalling AgenShield

​

Installation

​

Campaign install (the normal path)

curl -fsSL '<CAMPAIGN_INSTALL_URL>' | bash

1. Detects the platform and architecture. macOS builds are Apple silicon only — on an Intel Mac the script stops with a clear message rather than installing something that cannot run.
2. Resolves the latest version from the agen-co/agenshield GitHub Releases API (or honors --version), then downloads the signed AgenShield-<version>-arm64.pkg from that release.
3. Stages the enrollment token for the installer, so the package can enroll the Mac without anyone typing anything in.
4. Runs sudo installer -pkg <pkg> -target /. In an interactive terminal the install then hands off to a guided stepper that walks the three System Settings approvals — security extension, Full Disk Access, and network filtering. Each step advances the moment the approval is detected (press Enter to re-check immediately), and it closes by confirming protection is active. Non-interactive runs — and runs with AGENSHIELD_INSTALL_HEADLESS=1 set — skip the stepper and log to /var/log/agenshield/install.log.

​

Manual install

npx agenshield install --cloud-url <CLOUD_URL> --token <TOKEN>
agenshield start
agenshield login   # optional — or sign in later from the AgenShield menubar

​

Windows

irm '<CAMPAIGN_INSTALL_URL>' | iex

1. Checks that the machine is 64-bit Windows — AgenShield for Windows does not yet support 32-bit or ARM devices, and the script stops with a clear message on those rather than installing something that cannot run.
2. Resolves the latest version for your organization’s release channel (or a pinned version), downloads the installer package, and verifies it against AgenShield’s release records before installing anything.
3. Stages your organization’s enrollment token so the installer can enroll the device without anyone typing anything in — including on a machine with no one signed in yet.
4. Installs silently, which registers AgenShield as a Windows service (so it starts automatically at boot) and installs the tray app.

​

What a macOS install does

1. Downloads the signed software. The app bundle and command-line tool, all code-signed and Apple-notarized.
2. Enrolls the Mac with your organization. The device generates its own cryptographic identity locally and registers against your organization’s AgenShield backend using the enrollment token from the install link. The private half of that identity never leaves the machine, and every later request is signed with it rather than with a shared secret or bearer token.
3. Installs the app and its extensions. /Applications/AgenShield.app is installed; launching it activates the two system extensions. See What gets installed for what each is responsible for.
4. Starts the background service. The service is registered to run at boot, and a per-user item starts the menubar app at login. The service begins syncing your organization’s policy immediately.

​

What a Windows install does

1. Verifies the installer. Its checksum is checked against AgenShield’s release records before anything is installed.
2. Enrolls the device with your organization — if enrollment data is available. A token can reach the installer three ways: the install script’s staged handoff (the normal path above), a Group Policy or Intune-managed push, or a token passed directly on the installer’s command line. Whichever supplies it, the device generates its own cryptographic identity locally and registers with that token — the same model as macOS, so no shared secret or bearer token is used for later requests. Running the installer package directly, with none of those three sources present, installs the software but leaves the device unenrolled: the background service runs, but no organization policy has been pulled and nothing is protected until enrollment completes — either by supplying a token afterward, or automatically once a managed policy push arrives. See Windows install warnings if an unattended install did not enroll.
3. Installs the background service and the tray app. The service is registered to start automatically at boot. Once the device is enrolled, it syncs your organization’s policy and enforces your organization’s network policy; the tray app gives the signed-in user status and controls.

​

Key files and locations

​

Uninstallation

​

CLI-driven teardown (preferred)

agenshield uninstall        # add --yes for scripted, non-interactive runs

agenshield doctor --cleanup-extensions

​

Campaign-served uninstall.sh

curl -fsSL '<CAMPAIGN_URL>/uninstall.sh' | bash

​

Manual fallback

sudo launchctl bootout system/com.frontegg.AgenShield.daemon 2>/dev/null || true
sudo launchctl bootout system/com.frontegg.AgenShield.privilege-helper 2>/dev/null || true
launchctl bootout "gui/$(id -u)/com.frontegg.AgenShield.menubar" 2>/dev/null || true

sudo /Applications/AgenShield.app/Contents/MacOS/AgenShield --uninstall-all 2>/dev/null || true

# Delete every AgenShield root from the System keychain by SHA-1 — the CN
# varies ("AgenShield CA", "AgenShield Dev CA", "AgenShield MITM CA (…)"), so a
# fixed -c name misses variants. This mirrors what `agenshield uninstall` does.
security find-certificate -a -Z -c "AgenShield" /Library/Keychains/System.keychain 2>/dev/null \
  | awk '/^SHA-1/ {print $3}' \
  | while read -r SHA; do sudo security delete-certificate -Z "$SHA" /Library/Keychains/System.keychain 2>/dev/null || true; done

# Drop the node-ca-trust LaunchAgent and clear the env it set.
launchctl bootout "gui/$(id -u)/com.frontegg.AgenShield.node-ca-trust" 2>/dev/null || true
launchctl unsetenv NODE_EXTRA_CA_CERTS 2>/dev/null || true

sudo rm -f /Library/LaunchDaemons/com.frontegg.AgenShield.*.plist
rm -f ~/Library/LaunchAgents/com.frontegg.AgenShield.*.plist

sudo rm -rf /Library/AgenShield \
            /opt/agenshield \
            /Applications/AgenShield.app \
            /etc/agenshield
sudo rm -f /usr/local/bin/agenshield

sudo rm -rf ~/.agenshield

for RECEIPT in com.frontegg.agenshield.core \
               com.frontegg.agenshield.app \
               com.frontegg.agenshield.bootstrap; do
  sudo pkgutil --forget "$RECEIPT" 2>/dev/null || true
done

​

Verify a clean removal

systemextensionsctl list | grep frontegg        # should be empty (may need reboot)
pkgutil --pkgs | grep frontegg                  # should be empty
ls /Library/AgenShield /opt/agenshield /Applications/AgenShield.app 2>/dev/null
ls ~/.agenshield 2>/dev/null
sudo security find-certificate -c "AgenShield CA" /Library/Keychains/System.keychain 2>/dev/null
# ^ should print nothing (no AgenShield root left in the trust store)

​

Troubleshooting

• Operation not permitted on launchctl bootout — run with sudo; if it still fails, the service was already unloaded, so proceed.
• Extension still shows [activated enabled] — the app bundle’s --uninstall-all failed (the app may already be gone). Reinstall the app and re-run the CLI uninstall, or run sudo systemextensionsctl uninstall 3R2X6557U2 com.frontegg.AgenShield.es-extension (and .network-extension) with developer mode enabled.
• ~/.agenshield keeps being recreated — the background service LaunchDaemon is still bootstrapped; confirm the launchctl bootout step succeeded (no com.frontegg.AgenShield.daemon in sudo launchctl list).

​

Related commands

• agenshield install — installs or repairs a self-managed installation.
• agenshield activate — walks through the three macOS approvals.
• agenshield status — confirms what is running after either operation.
• agenshield doctor --cleanup-extensions — purges stale system extensions.
• agenshield uninstall — the authoritative removal path.

​

Next