I want to be able to uninstall Little Snitch over Apple Remote Desktop. I came across the script below here: http://fromtheadmin.com/kill-and-remove-little-snitch-application-via-ard-script/

However when I run the script locally on a test machine with Little Snitch running, Terminal returns "No matching processes belonging to you were found". I can see the Little Snitch UIAgent and Little Snitch Network Monitor processes in Activity Monitor running under the same account as the script is being executed from.

Any ideas?

NetworkMonitor="Little Snitch Network Monitor"
UIAgent="Little Snitch UIAgent"

#remove Little Snitch files and User Preferences

if [ -f $File ] ; then

#Kill Little Snitch Processes
killall $NetworkMonitor
killall $UIAgent

rm -R /Library/Application\ Support/Objective\ Development/
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchNetworkMonitor.plist
rm -R /Library/LaunchAgents/at.obdev.LittleSnitchUIAgent.plist
rm -R /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
rm -R /Library/Little\ Snitch/*
rm -R /Library/Logs/LittleSnitchDaemon.log
rm -R /System/Library/Extensions/LittleSnitch.kext
rm -R "/Applications/Little Snitch Configuration.app"

usr/sbin/jamf displayMessage -message "Computer is shutting down"

sleep 10

reboot -q

exit 0


exit 0



  • After running and the reboot has Little Snitch gone? In fact how do you see them i the Activity monitor after running?
    – mmmmmm
    Jul 15, 2012 at 22:06
  • It doesn't get to the reboot, just straight away to: No matching processes belonging to you were found.
    – Paul
    Jul 15, 2012 at 23:05
  • 1
    I feel I have to ask: in what situation would you want to remove LS via remote desktop? What motivation is there to interfere with the security on a remove machine?
    – Joost
    Oct 23, 2012 at 19:07
  • Managing machines across an enterprise where users have installed LS.
    – Paul
    Nov 20, 2012 at 3:20
  • Putting this on hold. Needs an edit to explain if jamf is running the script and what version of jamf and LS are in play. What worked in 2016 might not be apropos in 2017 and it's not very hard to know what the issue is for now. No need to delete this, just that it needs cleanup to allow more answers.
    – bmike
    Jan 22, 2017 at 22:22

3 Answers 3


There are multiple problems with that script:

  1. Bare string variables with embedded whitespace: put "" around the killall arguments.
  2. Overkill: if you're going to remove the software and reboot, there's no need to whack processes. There's a risk with LS that you could shoot your own session (and script) if taking out the LS processes glitches the network. If you believe you need to kill processes that act as gatekeepers for network traffic, you should make sure your script is not subject to normal hangup handling (see the man pages for nohup and batch for ways to do that)
  3. Underkill: if you're committed to killing the active components of LS before reboot to be sure (i.e. as if it were self-protective) you need to also take out the Little Snitch Daemon process and unload the kernel extension. There are also logs, caches, prefs, and support files in the user-specific Library trees.
  4. Not running as root: killing Little Snitch Daemon, unloading the kext, removing most (if not all) of the system-wide components, removing user-specific support files for multiple users, and rebooting all require root.
  5. Running reboot -q: Don't do that. It's safer on modern MacOS than it historically has been, but it can still be trouble. Better to use shutdown -r +1 "Rebooting for software change" which gives a minute grace period, posts that message to any interactive shells, and uses the proper launchd mechanisms to shut everything down. If you want to be less polite, use "now" and/or no message.

ALERT: This answer has been tried and apparently does not work. However, I am leaving the answer here in order to help others diagnose the issue.

When you run the script, $NetworkMonitor becomes Little Snitch Network Monitor instead of the required "Little Snitch Network Monitor" (to deal with the spaces).

I would change the first three lines of your code to:

NetworkMonitor="\"Little Snitch Network Monitor\""
UIAgent="\"Little Snitch UIAgent\""

I think that might take care of your issue. If not, let me know.

  • I have just attempted that, but get the same result. The output from Terminal is below: TestMac:~ TestUser$ sh /Users/TestUser/Desktop/LS\ Script\ Test/LS.sh No matching processes belonging to you were found No matching processes belonging to you were found override rw-r--r-- root/wheel for /Library/Application Support/Objective Development//Little Snitch/.lsd?
    – Paul
    Jul 15, 2012 at 23:51
  • How about trying to skip using the variables ($UIAgent and $NetworkMonitor) and placing the process names directly with the killall commands (enclosed in quotes, still). Jul 16, 2012 at 2:16
  • I have just attempted to run the original script as root over ARD and it seems to have worked (without any modification). Will test it further but it may have just need to be run as root. Will post back later.
    – Paul
    Jul 16, 2012 at 2:39

You'll need to log in as as an administrative user and run the script as the root user by typing "sudo" in front of your commands:

sudo /path/to/your/script.sh

Not the answer you're looking for? Browse other questions tagged .