Mac Uninstall McAfee Endpoint Security: Forced Removal Workaround for Stubborn Admin Locks

Uninstalling McAfee Endpoint Security from your Mac can feel like wrestling with a stubborn gremlin—especially when admin locks throw up roadblocks. 🔧 I’ve spent hours untangling these installs, and the key is knowing where McAfee hides its hooks in the system.

The standard uninstaller often leaves traces behind, but this method ensures every file, process, and hidden preference gets scrubbed clean.

First, back up important files and disable McAfee’s real-time protection if it’s still running—otherwise, you’ll trigger false alarms mid-uninstall. Then, we’ll use a combination of the official uninstaller, Terminal commands to hunt down leftover files, and a deep dive into LaunchAgents to confirm nothing’s lurking.

This isn’t just a quick drag-to-trash job; it’s a systematic cleanup that works even when admin permissions are locked down.

By the end, your Mac will be free of McAfee’s remnants, with no lingering processes or background services. You’ll verify the removal by checking Applications, LaunchAgents, and even Activity Monitor to ensure nothing’s still running.

The best part? This method works on macOS Ventura, Sonoma, and even older versions—no matter how stubborn the install was.

If you hit snags—like permission errors or hidden files—we’ll cover those too, with Terminal commands to force removal when the GUI won’t cooperate. Think of this as the nuclear option for McAfee cleanup, but with just enough precision to avoid collateral damage. Let’s get started.

What you need

Step-by-Step instructions for forcibly removing McAfee endpoint security from macOS

Here’s the direct method I use when standard uninstallers fail due to admin locks or corrupted files.

Restart your Mac and hold Shift immediately after the startup chime to boot into Safe Mode. This prevents McAfee from loading critical services, making removal possible. You’ll know you’re in Safe Mode when the login screen shows “Safe Boot” in the menu bar.

Log in with an administrator account—this is critical because Safe Mode restricts non-admin actions. If you don’t have admin access, you’ll need to reset the password first (hold Command-R at startup to enter Recovery Mode). Once logged in, proceed to the next step without exiting Safe Mode.

Open Finder and navigate to these three locations—each contains McAfee components that the uninstaller might miss:

1. Applications: Drag McAfee Endpoint Security from /Applications to the Trash. If it’s locked, right-click and select Get Info, then check Lock to unlock before moving.

2. Library Folders: Press Command-Shift-G and enter ~/Library/Application Support/McAfee. Delete every file and folder inside. Repeat for /Library/Application Support/McAfee (the system-wide folder). If you see a “Permission denied” error, authenticate with an admin password.

3. LaunchAgents and LaunchDaemons: Navigate to ~/Library/LaunchAgents and /Library/LaunchDaemons. Delete any files with “McAfee” in the name. These are background processes that restart McAfee automatically.

Open Terminal and run these commands one by one. Each targets a different layer of McAfee’s persistence:

1. List loaded kernel extensions: Type kextstat | grep -i mcafee. Note any extensions listed—you’ll remove them next.

2. Unload extensions (if running): For each extension (e.g., com.mcafee.driver), run sudo kextunload -b com.mcafee.driver. Replace the bundle ID with the exact name from kextstat. If you get “Kext not found”, skip it.

3. Delete extension files: Run sudo rm -rf /Library/Extensions/.mcafee and sudo rm -rf /System/Library/Extensions/.mcafee. This removes the core drivers that McAfee uses to hook into macOS.

McAfee leaves behind preference files and caches that can cause conflicts. In Terminal, run:

1. Reset launch services: sudo launchctl remove com.mcafee. (this removes all McAfee launch agents).

2. Clear caches: sudo rm -rf /Library/Caches/com.mcafee. and sudo rm -rf ~/Library/Caches/com.mcafee.*. This prevents McAfee from reloading settings on reboot.

3. Rebuild kernel cache: Run sudo kextcache -i /. This ensures macOS recognizes the absence of McAfee extensions. Finally, restart your Mac normally—no need to hold Shift this time.

After rebooting, open Terminal and run kextstat | grep -i mcafee. If no results appear, McAfee is fully removed. For extra assurance, search your drive for “McAfee” using Spotlight (Command-Space)—no files should remain.

Install a replacement security suite like Bitdefender or Sophos to avoid leaving your Mac vulnerable. If you encounter login issues after removal, reset the System Management Controller (SMC) by holding Shift-Control-Option and powering off/on your Mac.

Tips & tricks for forced McAfee removal on macOS

Here's what I've learned from years of wrestling with stubborn security software—these tricks save time and frustration when the standard uninstaller fails.

Safe Mode Timing: The moment you release Shift after startup, count to 30 seconds before letting go. This ensures macOS fully loads Safe Mode before you log in. I've seen people accidentally boot normally when they release too early—don't make that mistake. In Step 1, if your screen shows "Safe Boot" in the menu bar, you're golden. If not, restart and try again immediately after the chime.

File Locking Strategy: When you encounter locked files in Step 2, don't force-delete them. Instead, right-click → Get Info and uncheck Locked first. I've had McAfee files that appeared locked but actually required this step before moving to Trash. For the /Library/Application Support/McAfee folder, you might need to authenticate twice—once to open the folder, once to delete contents. Keep your admin password handy.

Terminal Command Backup: Before running any sudo commands in Step 3, open a new Terminal window and type sudo -l. This shows your current sudo privileges. If you see matching defaults for McAfee commands, you're good to proceed. I've had cases where admin accounts had restricted sudo access—this check prevents wasted time when commands fail with permission errors.

Verification Double-Check: In Step 5, after running kextstat | grep -i mcafee, you might see a few false positives. To be absolutely sure, run mdfind "kMDItemFSName == 'McAfee'" in Terminal. This Spotlight command searches every file and folder name for McAfee remnants. If nothing appears, you've truly removed everything. I've had users miss hidden preference files this way—don't skip this final verification.