Uninstall the macOS Forwarder

Removing the macOS forwarder takes four steps and the order matters. It is anti-tamper protected, which means it resists exactly the thing an uninstall is: something trying to stop it. So you unlock it first, with a token that proves the request came from your console rather than from whatever is running on the machine.

Before you start, know what removal does not do. The machine's asset record and every file it reported stay where they are, searchable and still matching YARA rules written later. Uninstalling ends collection going forward and erases nothing already collected. If you want the machine to stop reporting temporarily, Sleep and Wake Forwarders is reversible and keeps the coverage.

Step 1: Generate a maintenance token

In the Stairwell console, open the Assets tab, select Forwarder Maintenance Token, then Generate, and copy the token.

Two properties to plan around, because both produce confusing failures later. Tokens are scoped to one environment, so if you manage several, select the right one before generating. Tokens are valid for 14 days, so a token generated for a rollout that slipped will need regenerating. See Asset Identifiers.

Step 2: Unlock the forwarder

sudo "/Applications/Inception Forwarder.app/Contents/MacOS/Inception Forwarder" unlock --token [your token here]

Replace [your token here] with the token from Step 1. This is what turns off anti-tamper protection for the removal. See Anti-Tamper Protection for what it is otherwise doing.

Step 3: Uninstall the system extension

sudo "/Applications/Inception Forwarder.app/Contents/MacOS/Inception Forwarder" uninstall-extension

Technically optional, and strongly recommended. Skipping it is the usual cause of trouble deleting the application in Step 4, because the extension is still loaded and macOS objects.

Step 4: Remove the application

Either drag Inception Forwarder.app from /Applications to the Trash, or:

sudo rm -rf "/Applications/Inception Forwarder.app"

In short

1. Generate a maintenance token.
2. Unlock the forwarder with it.
3. Uninstall the system extension.
4. Delete the application.

Doing them out of order is what produces a half-removed forwarder that neither reports nor uninstalls cleanly. If you reach that state, generate a fresh token and start again at Step 2.

What should I read next?

• Anti-Tamper Protection, for why Step 2 exists.
• Sleep and Wake Forwarders, if the machine is coming back.
• Archive Inactive Assets, for tidying the fleet list afterwards.