Install on macOS

One signed package covers Intel and Apple silicon. Installing it takes three things: run the installer, approve the system extension, and grant full disk access. The third one is the step people miss, and a forwarder without it starts, registers, and collects nothing.

This page is the manual install on a single machine, which is what you want for a pilot host or a test. For a fleet, deliver the package and its configuration profiles through your device management platform, so the extension approval and the disk access grant are already in place when the package lands and no user is prompted.

What do I need before I start?

Your environment ID and a forwarder authentication token for it. See Environments.
The installer package. Get the current one from Forwarder Downloads.
Administrator rights on the machine, and physical or remote access to click through two approval prompts.
A clean connectivity result from that network. See Pre-Deployment Check.

Which host should I install on first?

Not a critical one. The initial backscan reads the whole disk and is resource-intensive while it runs, and the first machines you install on upload the most, because none of what they hold is known to Stairwell yet. Each subsequent machine of the same kind finds far less. Start with a lab machine or a standard build. Forwarder Deployment covers the full order.

How do I install the package?

Copy the package to the machine.
Open Terminal, change to the folder holding it, and run the installer. Substitute the filename you downloaded, since it carries the version:
```
sudo installer -package InceptionForwarder-1.7.4.1493.pkg -target /
```
The installer prompts for your environment ID and authentication token. Enter both.
macOS prompts you to approve the forwarder's system extension. Open System Settings when prompted and allow it.
Grant full disk access. In System Settings, go to Privacy & Security, then Full Disk Access, and enable the entry for the Stairwell forwarder.

The forwarder is now installed with the permissions it needs. Steps 4 and 5 are not optional and not deferrable: without them, the process runs and can read almost nothing.

Why does it need full disk access?

Because macOS does not let a process read arbitrary files without it, and reading files is the whole job.

This is worth understanding rather than treating as a checkbox, because it is the source of the most common silent failure on macOS. A forwarder without full disk access starts normally, registers with Stairwell, appears in the asset list with a healthy check-in, and reports almost nothing. Nothing errors. The asset looks deployed. It is the same shape of failure as a TLS-inspecting proxy on the network side: everything reports success except the part you care about.

So the confirmation step below is not a formality. Check that objects are arriving, not only that the asset exists.

How do I confirm the install worked?

Log in to app.stairwell.com and open Assets.
Find the new asset and confirm a recent check-in. See Assets.
Open the asset and confirm objects are arriving. Allow a few minutes for collection to begin.
Confirm the asset landed in the environment you meant and carries the policy you meant.

If the asset registered but objects are not arriving, check full disk access first, then connectivity. Those two account for nearly all of it. See Connectivity Requirements.

What is different when I deploy this at scale?

Three configuration profiles, delivered by your device management platform, replace the manual approval steps:

A forwarder settings profile, which supplies the forwarder's configuration.
A system extension policy profile, which pre-approves the extension so no user is prompted.
A privacy preferences profile, which grants full disk access.

Get them from Forwarder Downloads. Push them before or alongside the package, never after: a forwarder that installs first will prompt the user, and a user who dismisses the prompt leaves you with an asset that looks deployed and is not collecting.

The profiles are versioned separately from the forwarder, so a forwarder upgrade does not normally mean re-pushing them.

Detailed procedures for specific management platforms are published separately in this documentation set. This page stays deliberately generic, because the sequence above is the part that matters and it is the same everywhere.

How do I update or remove it later?

The macOS forwarder has tamper protection, which means it resists being stopped, altered, or uninstalled. That is the point of it, and it has a consequence for maintenance: an out-of-band update or an uninstall needs the forwarder put into maintenance mode first, using a maintenance token generated from the Stairwell console.

If you are updating rather than removing, the console can do it for you and no maintenance token is involved. That is the path to prefer. See Update the Forwarders in a Group.

What should I read next?

Update the Forwarders in a Group, for pushing an upgrade from the console.
Forwarder Downloads, for the current package, the configuration profiles, and supported macOS versions.
Asset Configuration, for tuning what the forwarder collects and how hard it works.