Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to uninstall Little Snitch over Apple Remote Desktop. I came across the script below here:

However when I run the script locally on a test machine with Little Snitch running, Terminal returns "No matching processes belonging to you were found". I can see the Little Snitch UIAgent and Little Snitch Network Monitor processes in Activity Monitor running under the same account as the script is being executed from.

Any ideas?

NetworkMonitor="Little Snitch Network Monitor"
UIAgent="Little Snitch UIAgent"

#remove Little Snitch files and User Preferences

if [ -f $File ] ; then

#Kill Little Snitch Processes
killall $NetworkMonitor
killall $UIAgent

rm -R /Library/Application\ Support/Objective\ Development/
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchUIAgent.plist
rm -R /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
rm -R /Library/Little\ Snitch/*
rm -R /Library/Logs/LittleSnitchDaemon.log
rm -R /System/Library/Extensions/LittleSnitch.kext
rm -R "/Applications/Little Snitch"

usr/sbin/jamf displayMessage -message "Computer is shutting down"

sleep 10

reboot -q

exit 0


exit 0



share|improve this question
After running and the reboot has Little Snitch gone? In fact how do you see them i the Activity monitor after running? – Mark Jul 15 '12 at 22:06
It doesn't get to the reboot, just straight away to: No matching processes belonging to you were found. – Paul Jul 15 '12 at 23:05
I feel I have to ask: in what situation would you want to remove LS via remote desktop? What motivation is there to interfere with the security on a remove machine? – Joost Oct 23 '12 at 19:07
Managing machines across an enterprise where users have installed LS. – Paul Nov 20 '12 at 3:20

There are multiple problems with that script:

  1. Bare string variables with embedded whitespace: put "" around the killall arguments.
  2. Overkill: if you're going to remove the software and reboot, there's no need to whack processes. There's a risk with LS that you could shoot your own session (and script) if taking out the LS processes glitches the network. If you believe you need to kill processes that act as gatekeepers for network traffic, you should make sure your script is not subject to normal hangup handling (see the man pages for nohup and batch for ways to do that)
  3. Underkill: if you're committed to killing the active components of LS before reboot to be sure (i.e. as if it were self-protective) you need to also take out the Little Snitch Daemon process and unload the kernel extension. There are also logs, caches, prefs, and support files in the user-specific Library trees.
  4. Not running as root: killing Little Snitch Daemon, unloading the kext, removing most (if not all) of the system-wide components, removing user-specific support files for multiple users, and rebooting all require root.
  5. Running reboot -q: Don't do that. It's safer on modern MacOS than it historically has been, but it can still be trouble. Better to use shutdown -r +1 "Rebooting for software change" which gives a minute grace period, posts that message to any interactive shells, and uses the proper launchd mechanisms to shut everything down. If you want to be less polite, use "now" and/or no message.
share|improve this answer

ALERT: This answer has been tried and apparently does not work. However, I am leaving the answer here in order to help others diagnose the issue.

When you run the script, $NetworkMonitor becomes Little Snitch Network Monitor instead of the required "Little Snitch Network Monitor" (to deal with the spaces).

I would change the first three lines of your code to:

NetworkMonitor="\"Little Snitch Network Monitor\""
UIAgent="\"Little Snitch UIAgent\""

I think that might take care of your issue. If not, let me know.

share|improve this answer
I have just attempted that, but get the same result. The output from Terminal is below: TestMac:~ TestUser$ sh /Users/TestUser/Desktop/LS\ Script\ Test/ No matching processes belonging to you were found No matching processes belonging to you were found override rw-r--r-- root/wheel for /Library/Application Support/Objective Development//Little Snitch/.lsd? – Paul Jul 15 '12 at 23:51
How about trying to skip using the variables ($UIAgent and $NetworkMonitor) and placing the process names directly with the killall commands (enclosed in quotes, still). – Nathan Jul 16 '12 at 2:16
I have just attempted to run the original script as root over ARD and it seems to have worked (without any modification). Will test it further but it may have just need to be run as root. Will post back later. – Paul Jul 16 '12 at 2:39

You'll need to log in as as an administrative user and run the script as the root user by typing "sudo" in front of your commands:

sudo /path/to/your/
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.