Disabled Software removal in Big Sur

[iamasmith]

I've been cleaning up after migrating data into Big Sur on a brand new iMac 2020 from an old Mac running Catalina.

As part of this exercise I removed all Drobo software, Wacom software and Razer software which still left some kexts so I ended up manually purging them, all the LaunchAgents and all the LaunchDaemons associated with them but I can't for the life of me figure what I'm missing to clear the 'Disabled Software' section in the system report.

It still shows this software, even though as far as I can tell it's completely gone, and I wonder if it's just lodged in a plist or sqlite database that the system uses once it's spotted something.

I figured the 'No User Consent' was related to approvals in the Security Preference pane but there is nothing there waiting approval.

It looks pretty much like this so any pointers on how to complete the cleanup? (no Mac Cleanup software suggestions please)

Andy

 

[Taz Mangus]

Did you try restarting the computer after you removed the kexts and look if it disappeared?

 

[fisherking]

i have a kext file that i cannot remove (with any app, in the terminal...). it's not budging. and so it sits there, and life goes on.

if you aren't running any apps or processes that use these files, i wouldn't worry about it.

 

[iamasmith]

Yes I rebooted, no difference, I even disabled SIP so I could purge the Migration History which had a number of system protected files (re-enabled afterwards).

I know this isn't really an issue, it just doesn't seem clean

 

[Taz Mangus]

Yes I rebooted, no difference, I even disabled SIP so I could purge the Migration History which had a number of system protected files (re-enabled afterwards).

I know this isn't really an issue, it just doesn't seem clean

The other option would be to do a clean install and migrate from backup. That would certainly do the cleanup.

Now that I think about this more, have you look to see if it is possible a hidden file (command-key shift-key .-key)?

 

[iamasmith]

This is what I did, the backup migration, where I just chose apps and personal data brought all this baggage back.

I've been at the filesystem constantly through the terminal, which is how I managed to remove the kexts. Went into recovery mode to do the csrutil disable so that I could purge the Migration History etc. and have grepped through files that I can find in /Library which should cover all non Apple extensions.

It does seem that these files have been recorded somewhere outside of the filesystem, possibly in some database.

 

[Ritsuka]

Try
sudo kextcache -prune-staging

in Terminal.

 

[iamasmith]

Try
sudo kextcache -prune-staging

in Terminal.

yup, done that too

 

[honestone33]

Whenever I want to completely remove a program and all its files, I first use AppCleaner:

AppCleaner

It does a very good job of getting rid of most of the files associated with an app (and of course the app itself). Then I run EasyFind:

Download EasyFind for Mac | MacUpdate

Download the latest version of EasyFind for Mac for free. Read 193 user reviews and compare with similar apps on MacUpdate.

www.macupdate.com

I just put in the app name )or part of it) in the Search bar, and it does a very good job in finding more files associated with the app.

 

[iamasmith]

Whenever I want to completely remove a program and all its files, I first use AppCleaner:

AppCleaner

It does a very good job of getting rid of most of the files associated with an app (and of course the app itself). Then I run EasyFind:

Download EasyFind for Mac | MacUpdate

Download the latest version of EasyFind for Mac for free. Read 193 user reviews and compare with similar apps on MacUpdate.

www.macupdate.com

I just put in the app name )or part of it) in the Search bar, and it does a very good job in finding more files associated with the app.

Absolutely not, I mentioned this in the first post. If it's open source thanks, I'll read the source and find out how to do that bit from the source but I'm not ever touching any of these things.

 

[honestone33]

Absolutely not, I mentioned this in the first post. If it's open source thanks, I'll read the source and find out how to do that bit from the source but I'm not ever touching any of these things.

Well, it has always worked flawlessly for me. I absolutely endorse both products.

 

[fisherking]

again, i could not remove one kext file; not with SIP disabled, not even with help from the developer (i obsess about these things, too). so i let it go...

 

[honestone33]

Once in a while, there are some files I cannot remove, even after using AppCleaner and EasyFind. They look rather obscure to me, and take up very little space. I just don't worry about them. As long as I continue to do my cleanup/maintenance/repair tasks, I am good to go.

 

[sxbsxb]

I've been cleaning up after migrating data into Big Sur on a brand new iMac 2020 from an old Mac running Catalina.

As part of this exercise I removed all Drobo software, Wacom software and Razer software which still left some kexts so I ended up manually purging them, all the LaunchAgents and all the LaunchDaemons associated with them but I can't for the life of me figure what I'm missing to clear the 'Disabled Software' section in the system report.

I just discovered how to do this. It's a bit tricky. And it may be dangerous to your system software if you mess up. You need to use sqlite3 to peruse and manipulate a database in your start up disk's file /var/db/SystemPolicyConfiguration/KextPolicy

In my case, software that I used many years ago on a previous iMac was long gone but that database still had a record of two items and they showed up only in that Disabled Software report. They didn't hurt anything, but it was irritating to see them.

That database file is read-only unless you boot in Recovery Mode (Command - R), but you want to examine the contents and print the information in a normal session so you have it when you are in Recovery Mode. To get the info:

Start up a terminal window
cd /var/db/SystemPolicyConfiguration
sudo sqlite3 KextPolicy

You now should have a prompt: sqlite>

Type: .tables

I got a list of 6 items. In my case, the annoying Disabled Software was in the "kext_policy" table.

Then type the following sqlite3 command (you have to terminate every sqlite3 query that isn't prefixed with a . with a ; (semi-colon) )

select * from kext_policy ;

You will see several items (I had 12 of them) that look like:

6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|8

This is something from HP printer software that I had installed at some point and is not causing me problems, so I left it (and several other items) there.

The columns separated by the | character are (in order) Team_ID, Bundle_ID, Allowed, Developer_Name, Flags

You may not have a Team_ID on some items.

Hopefully, you have lines associated with the software in *your* Disabled Software report. If not try another item in the .tables list. Or, try a different file in that directory?

Now record or print that data.

To exit sqlite3, type: .quit

Now, you are ready to boot in Recovery Mode.
When there, in the menus choose Utilities -> Terminal

You will be root/administrator, so be careful!

cd /Volumes/[start up disk]/usr/bin

./sqlite3 /Volumes/[start up disk]/var/db/SystemPolicyConfiguration/KextPolicy

Again you should have an sqlite> prompt.

select * from kext_policy ;

and confirm you have the same information as before. To delete an item if it has a Team_ID:

delete from kext_policy where Team_ID = 'X123456789' ;

Repeat the select command to confirm it's gone.

If there is no Team_ID, for example, the "wacom" item in your list:

delete from kext_policy where Bundle_ID like '%wacom%' ;

Then .quit to get out of sqlite3, reboot and your system report disabled software should be clean of those items you deleted from the database.

Good luck!

 

[jeyf]

there will be files in the apple finder you will find diffiiuclt to remove.
you might google what people are doing
-review the file's permissions
-the Finder app has some tools you might over look. do the google.
-get a for free trial on some Finder alternatives. One such alternative gave a linux link you could use in terminal.
-try to move instead of delete

 

[sxbsxb]

there will be files in the apple finder you will find diffiiuclt to remove.
you might google what people are doing
-review the file's permissions
-the Finder app has some tools you might over look. do the google.
-get a for free trial on some Finder alternatives. One such alternative gave a linux link you could use in terminal.
-try to move instead of delete

The whole point is that the items listed in the System Report Disabled Software that bothered @iamasmith and the items that irritated me are not files. It may refer to files that have long ago been deleted. The items get listed because they are in the KextPolicy database and are flagged as needing user permission -- the "No User Consent" in the "Reason". You cannot get User Consent unless the software is installed and then would be accessible via System Preferences -> Security & Privacy.

Your suggestions are not bad, but they do not apply to this situation.

 

[excelsior.ink]

I just discovered how to do this. It's a bit tricky. And it may be dangerous to your system software if you mess up. You need to use sqlite3 to peruse and manipulate a database in your start up disk's file /var/db/SystemPolicyConfiguration/KextPolicy

In my case, software that I used many years ago on a previous iMac was long gone but that database still had a record of two items and they showed up only in that Disabled Software report. They didn't hurt anything, but it was irritating to see them.

That database file is read-only unless you boot in Recovery Mode (Command - R), but you want to examine the contents and print the information in a normal session so you have it when you are in Recovery Mode. To get the info:

Start up a terminal window
cd /var/db/SystemPolicyConfiguration
sudo sqlite3 KextPolicy

You now should have a prompt: sqlite>

Type: .tables

I got a list of 6 items. In my case, the annoying Disabled Software was in the "kext_policy" table.

Then type the following sqlite3 command (you have to terminate every sqlite3 query that isn't prefixed with a . with a ; (semi-colon) )

select * from kext_policy ;

You will see several items (I had 12 of them) that look like:

6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|8

This is something from HP printer software that I had installed at some point and is not causing me problems, so I left it (and several other items) there.

The columns separated by the | character are (in order) Team_ID, Bundle_ID, Allowed, Developer_Name, Flags

You may not have a Team_ID on some items.

Hopefully, you have lines associated with the software in *your* Disabled Software report. If not try another item in the .tables list. Or, try a different file in that directory?

Now record or print that data.

To exit sqlite3, type: .quit

Now, you are ready to boot in Recovery Mode.
When there, in the menus choose Utilities -> Terminal

You will be root/administrator, so be careful!

cd /Volumes/[start up disk]/usr/bin

./sqlite3 /Volumes/[start up disk]/var/db/SystemPolicyConfiguration/KextPolicy

Again you should have an sqlite> prompt.

select * from kext_policy ;

and confirm you have the same information as before. To delete an item if it has a Team_ID:

delete from kext_policy where Team_ID = 'X123456789' ;

Repeat the select command to confirm it's gone.

If there is no Team_ID, for example, the "wacom" item in your list:

delete from kext_policy where Bundle_ID like '%wacom%' ;

Then .quit to get out of sqlite3, reboot and your system report disabled software should be clean of those items you deleted from the database.

Good luck!

This didn't work for me, when in Recovery Mode in Terminal there was nothing listed in: /Volumes/Macintosh\ HD/var/db/SystemPolicyConfiguration/ this folder is empty.

Big Sur 11.4, M1 MBP

 

[excelsior.ink]

After disabling SIP you can edit the KextPolicy with the system running in normal mode. Of course, enable SIP after finished.
Thank you for this!

 

[razyalov]

I just discovered how to do this. It's a bit tricky. And it may be dangerous to your system software if you mess up. You need to use sqlite3 to peruse and manipulate a database in your start up disk's file /var/db/SystemPolicyConfiguration/KextPolicy

In my case, software that I used many years ago on a previous iMac was long gone but that database still had a record of two items and they showed up only in that Disabled Software report. They didn't hurt anything, but it was irritating to see them.

That database file is read-only unless you boot in Recovery Mode (Command - R), but you want to examine the contents and print the information in a normal session so you have it when you are in Recovery Mode. To get the info:

Start up a terminal window
cd /var/db/SystemPolicyConfiguration
sudo sqlite3 KextPolicy

You now should have a prompt: sqlite>

Type: .tables

I got a list of 6 items. In my case, the annoying Disabled Software was in the "kext_policy" table.

Then type the following sqlite3 command (you have to terminate every sqlite3 query that isn't prefixed with a . with a ; (semi-colon) )

select * from kext_policy ;

You will see several items (I had 12 of them) that look like:

6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|8

This is something from HP printer software that I had installed at some point and is not causing me problems, so I left it (and several other items) there.

The columns separated by the | character are (in order) Team_ID, Bundle_ID, Allowed, Developer_Name, Flags

You may not have a Team_ID on some items.

Hopefully, you have lines associated with the software in *your* Disabled Software report. If not try another item in the .tables list. Or, try a different file in that directory?

Now record or print that data.

To exit sqlite3, type: .quit

Now, you are ready to boot in Recovery Mode.
When there, in the menus choose Utilities -> Terminal

You will be root/administrator, so be careful!

cd /Volumes/[start up disk]/usr/bin

./sqlite3 /Volumes/[start up disk]/var/db/SystemPolicyConfiguration/KextPolicy

Again you should have an sqlite> prompt.

select * from kext_policy ;

and confirm you have the same information as before. To delete an item if it has a Team_ID:

delete from kext_policy where Team_ID = 'X123456789' ;

Repeat the select command to confirm it's gone.

If there is no Team_ID, for example, the "wacom" item in your list:

delete from kext_policy where Bundle_ID like '%wacom%' ;

Then .quit to get out of sqlite3, reboot and your system report disabled software should be clean of those items you deleted from the database.

Good luck!

THANK YOU!!!! I was trying to figure this out for a couple of years now. Had 3+ months-long support sessions with Apple and their people didn't know where to find this database!!!! Finally, my disabled software list is clean and I can install drivers from the same providers! THANK YOU!!!! (YES I AM SHOUTING, BUT OF JOY!!!!)

 

[WCH0058]

I just discovered how to do this. It's a bit tricky. And it may be dangerous to your system software if you mess up. You need to use sqlite3 to peruse and manipulate a database in your start up disk's file /var/db/SystemPolicyConfiguration/KextPolicy

In my case, software that I used many years ago on a previous iMac was long gone but that database still had a record of two items and they showed up only in that Disabled Software report. They didn't hurt anything, but it was irritating to see them.

That database file is read-only unless you boot in Recovery Mode (Command - R), but you want to examine the contents and print the information in a normal session so you have it when you are in Recovery Mode. To get the info:

Start up a terminal window
cd /var/db/SystemPolicyConfiguration
sudo sqlite3 KextPolicy

You now should have a prompt: sqlite>

Type: .tables

I got a list of 6 items. In my case, the annoying Disabled Software was in the "kext_policy" table.

Then type the following sqlite3 command (you have to terminate every sqlite3 query that isn't prefixed with a . with a ; (semi-colon) )

select * from kext_policy ;

You will see several items (I had 12 of them) that look like:

6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|8

This is something from HP printer software that I had installed at some point and is not causing me problems, so I left it (and several other items) there.

The columns separated by the | character are (in order) Team_ID, Bundle_ID, Allowed, Developer_Name, Flags

You may not have a Team_ID on some items.

Hopefully, you have lines associated with the software in *your* Disabled Software report. If not try another item in the .tables list. Or, try a different file in that directory?

Now record or print that data.

To exit sqlite3, type: .quit

Now, you are ready to boot in Recovery Mode.
When there, in the menus choose Utilities -> Terminal

You will be root/administrator, so be careful!

cd /Volumes/[start up disk]/usr/bin

./sqlite3 /Volumes/[start up disk]/var/db/SystemPolicyConfiguration/KextPolicy

Again you should have an sqlite> prompt.

select * from kext_policy ;

and confirm you have the same information as before. To delete an item if it has a Team_ID:

delete from kext_policy where Team_ID = 'X123456789' ;

Repeat the select command to confirm it's gone.

If there is no Team_ID, for example, the "wacom" item in your list:

delete from kext_policy where Bundle_ID like '%wacom%' ;

Then .quit to get out of sqlite3, reboot and your system report disabled software should be clean of those items you deleted from the database.

Good luck!

To OP for posting the question and sxbsxb for providing the solution:

Thank you very much!

I've been clean installing in order to rid of these annoying disabled software items listed in system report. I'm competent enough but not completely tech savvy so your explanation to the nature of these entities and detailed instructions to erase them were extremely helpful.
To those who stumble upon this, pay attention to the space in the commands, because absence of it can not execute the command or could be worse. Practice some before using terminal in recovery mode if you're not 100% comfortable.
Also, if your startup disk is "Macintosh HD" then it should be noted as Macintosh\ HD (Macintosh-backslash-space-HD). Something I have learned along the way and as a note to my future self.

 

[Stratox]

I just discovered how to do this. It's a bit tricky. And it may be dangerous to your system software if you mess up. You need to use sqlite3 to peruse and manipulate a database in your start up disk's file /var/db/SystemPolicyConfiguration/KextPolicy

In my case, software that I used many years ago on a previous iMac was long gone but that database still had a record of two items and they showed up only in that Disabled Software report. They didn't hurt anything, but it was irritating to see them.

That database file is read-only unless you boot in Recovery Mode (Command - R), but you want to examine the contents and print the information in a normal session so you have it when you are in Recovery Mode. To get the info:

Start up a terminal window
cd /var/db/SystemPolicyConfiguration
sudo sqlite3 KextPolicy

You now should have a prompt: sqlite>

Type: .tables

I got a list of 6 items. In my case, the annoying Disabled Software was in the "kext_policy" table.

Then type the following sqlite3 command (you have to terminate every sqlite3 query that isn't prefixed with a . with a ; (semi-colon) )

select * from kext_policy ;

You will see several items (I had 12 of them) that look like:

6HB5Y2QTA3|com.hp.kext.io.enabler.compound|1|HP Inc.|8

This is something from HP printer software that I had installed at some point and is not causing me problems, so I left it (and several other items) there.

The columns separated by the | character are (in order) Team_ID, Bundle_ID, Allowed, Developer_Name, Flags

You may not have a Team_ID on some items.

Hopefully, you have lines associated with the software in *your* Disabled Software report. If not try another item in the .tables list. Or, try a different file in that directory?

Now record or print that data.

To exit sqlite3, type: .quit

Now, you are ready to boot in Recovery Mode.
When there, in the menus choose Utilities -> Terminal

You will be root/administrator, so be careful!

cd /Volumes/[start up disk]/usr/bin

./sqlite3 /Volumes/[start up disk]/var/db/SystemPolicyConfiguration/KextPolicy

Again you should have an sqlite> prompt.

select * from kext_policy ;

and confirm you have the same information as before. To delete an item if it has a Team_ID:

delete from kext_policy where Team_ID = 'X123456789' ;

Repeat the select command to confirm it's gone.

If there is no Team_ID, for example, the "wacom" item in your list:

delete from kext_policy where Bundle_ID like '%wacom%' ;

Then .quit to get out of sqlite3, reboot and your system report disabled software should be clean of those items you deleted from the database.

Good luck!

Still works, thank you so much!
macOS: 13.4.1 (c) (22F770820d)