Knowledge Base > Article [0077]

Recover your Mac machine

We strongly suggest you enable SSH before installing our Mac agent,

You can enable it in terminal,

sudo systemsetup -setremotelogin on

Make sure the machine can be ssh accessed from another machine.

In some situations, you may want to remove our agent. With ssh access, it is much easier to to do that. Run the following command

sudo "/Applications/MacLogon Uninstaller.app/Contents/MacOS/MacLogon Uninstaller" -uninstall

You ought to see the following result (similar)

2014-01-13 12:44:30.645 MacLogon Uninstaller[174:507] argc = 2

2014-01-13 12:44:30.655 MacLogon Uninstaller[174:507] argv[1] = -uninstall

2014-01-13 12:44:30.656 MacLogon Uninstaller[174:507] [SetupHelper] uninstall

2014-01-13 12:44:30.732 MacLogon Uninstaller[174:507] [SetupHelper] IsAuthorizationFileExists, return NO

2014-01-13 12:44:30.733 MacLogon Uninstaller[174:507] [SetupHelper] DisableScreenSaverRight

2014-01-13 12:44:30.986 MacLogon Uninstaller[174:507] [SetupHelper] uninstall succeeded

Without ssh access, the removal becomes complicated, it depends on what OSX version you are using. Here is a solution for 10.9 Mavericks.

Enter Mac Single-User Mode, you should see,

 

Execute the two commands in order. With the first command, you are expected to see the following result

 

The second command returns nothing, but make sure you type it right.

You may wonder if you can run the Uninstaller here, unfortunately, it will fail with error -60008

Instead, you need to delete the authorization database, with following command

rm /var/db/auth.db

Make sure the file auth.db is truely removed by list the folder

ls /var/db/

Now, you can reboot the machine by typing the last command

reboot

This "nuclear" way will also remove other Mac security plugins, like Centrify, so please only use it if there is no alternative.

For other versions (before 10.9), you can take a look of /etc/authorization file corrupted. Basically, you need to recover the file.

According to that link,

"there is an /etc/authorization file right on the install DVD. you can try booting from the DVD and copying this file to /etc/authorization on your computer from terminal."