Cisco AnyConnect & Secure Client Uninstall & Deployment Guide

1. Overview & Architectural Evolution of Cisco VPN on macOS

For over a decade, Cisco AnyConnect Secure Mobility Client (versions 4.1.x through 4.9.x) served as the standard enterprise remote access client for macOS. Historically, AnyConnect relied on legacy kernel extensions (KEXTs) such as CiscoVPN.kext and virtual TAP/TUN devices (tun.kext) to intercept network packets at layer 3.

With Apple's deprecation of third-party kernel extensions and the introduction of System Integrity Protection (SIP), macOS transitioned enterprise VPNs to the modern NetworkExtension framework. Rebranded as Cisco Secure Client (v5.x), the modern agent operates as userland system extensions governed by sysextd, alongside separate modules for DART (diagnostics), ISE Posture (compliance), and Umbrella (cloud DNS filtering).

However, when decommissioning AnyConnect or migrating endpoints to modern Zero Trust Network Access (ZTNA) solutions like Cloudflare One or Tailscale, standard dragging to Trash leaves behind active LaunchDaemons, socket listeners, and orphan network filters that can break user DNS resolution. Below are the complete interactive and headless silent removal workflows.

2. Interactive Uninstallation Script (AnyConnect 4.x)

The following battle-tested interactive script safely prompts the user before terminating active VPN connections, unlinks legacy kernel extensions, uninstalls DART/ISE/Umbrella, and triggers a clean system reboot to restore native routing tables:

bash

#!/bin/sh
######################################################################################################
## Script to remove Cisco Anyconnect on macOS                                                    #####
## Created by Shri Sivakumaran, Slack me @Shri / GitHub - macbudS                                #####
## This script will clean up Cisco Anyconnect 4.1.08005 to 4.9.xxx, tested in macOS 10.15.7 & 11 #####
## Cisco Anyconnect, Dart, iseposture and Umbrella will be removed                               #####
######################################################################################################

### Display message to close all application and files
MESSAGE=$(osascript -e 'display alert "Action need to be taken before uninstalling Cisco Anyconnecct" message "Kindly save and close all your files and application, your Mac will reboot at end of this process. click on Ok button once you closed application(s) and file(s)"buttons {"Cancel","Ok"}')

v=$(echo "$MESSAGE" | /usr/bin/awk -F "button returned:|," '{print $2}')
if [[ $v == 'Ok' ]]; then
sleep 20

MESSAGE=$(osascript -e 'display alert "Are you ready to uninstall Cisco Anyconnect..." message ""buttons {"No","Yes"}')

v=$(echo "$MESSAGE" | /usr/bin/awk -F "button returned:|," '{print $2}')
if [[ $v == 'Yes' ]]; then
echo "Cisco Anyconnect uninstaller starts..."

## Uninstalling Cisco Anyconnect, Dart, iseposture, umbrella
sh /opt/cisco/vpn/bin/vpn_uninstall.sh 2>/dev/null
sh /opt/cisco/vpn/bin/dart_uninstall.sh 2>/dev/null
sh /opt/cisco/anyconnect/bin/anyconnect_uninstall.sh 2>/dev/null
sh /opt/cisco/anyconnect/bin/vpn_uninstall.sh 2>/dev/null
sh /opt/cisco/anyconnect/bin/umbrella_uninstall.sh 2>/dev/null
sh /opt/cisco/anyconnect/bin/dart_uninstall.sh 2>/dev/null
sh /opt/cisco/anyconnect/bin/iseposture_uninstall.sh 2>/dev/null

## Cleaning leftover files and Profiles
rm -rf /System/Library/StartupItems/CiscoVPN
rm -rf /Library/StartupItems/CiscoVPN
rm -rf /System/Library/Extensions/CiscoVPN.kext
rm -rf /Library/Extensions/CiscoVPN.kext
rm -rf /Library/Receipts/vpnclient-kext.pkg
rm -rf /Library/Receipts/vpnclient-startup.pkg
rm -rf /Library/Frameworks/cisco-vpnclient.framework
rm -rf /Library/Extensions/tun.kext
rm -rf /Library/Extensions/tap.kext
rm -rf /Library/Receipts/vpnclient-api.pkg
rm -rf /Library/Receipts/vpnclient-bin.pkg
rm -rf /Library/Receipts/vpnclient-gui.pkg
rm -rf /Library/Receipts/vpnclient-profiles.pkg
rm -rf ~/Library/Preferences/com.cisco.VPNClient.plist
rm -rf /opt/cisco
pkgutil --forget com.cisco.pkg.anyconnect.vpn 2>/dev/null

## Uninstallation completed, displaying restart message
echo "uninstallation completed successfully"
osascript -e 'display alert "Cisco Anyconnect uninstallation completed" message "System will restart now"'
jamf recon
sleep 5
reboot

else
echo "process stopped"
osascript -e 'display alert "Cisco Anyconnect uninstallation process stopped" message "If you like to continue, run the policy again"'
fi
else
echo "User stopped the uninstallation process"
fi
exit 0

3. Modern Headless Silent Uninstallation (Cisco Secure Client 5.x & MDM)

In automated Jamf Pro, Kandji, or Microsoft Intune fleets running macOS Sonoma and Sequoia, interactive GUI popups are suppressed. Administrators require a zero-touch removal script that unloads launch daemons and cleans package receipts silently without hanging the client execution:

bash

#!/bin/bash
# ==============================================================================
# Silent Headless Cisco Secure Client & AnyConnect Uninstaller for MDM
# Target OS: macOS 12 Monterey through macOS 15 Sequoia (Apple Silicon & Intel)
# ==============================================================================

echo "[*] Terminating active Cisco background daemons..."
launchctl bootout system /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist 2>/dev/null
launchctl bootout system /Library/LaunchDaemons/com.cisco.secureclient.vpnagentd.plist 2>/dev/null

# Execute official uninstaller binaries if present
UNINSTALLERS=(
    "/opt/cisco/secureclient/bin/cisco_secure_client_uninstall.sh"
    "/opt/cisco/anyconnect/bin/anyconnect_uninstall.sh"
    "/opt/cisco/anyconnect/bin/vpn_uninstall.sh"
    "/opt/cisco/anyconnect/bin/umbrella_uninstall.sh"
    "/opt/cisco/anyconnect/bin/iseposture_uninstall.sh"
    "/opt/cisco/anyconnect/bin/dart_uninstall.sh"
)

for script in "${UNINSTALLERS[@]}"; do
    if [ -f "$script" ]; then
        echo "[+] Executing: $script"
        sh "$script" -q 2>/dev/null || true
    fi
done

echo "[*] Purging leftover application bundles and receipts..."
rm -rf "/Applications/Cisco"
rm -rf "/opt/cisco"
rm -rf /Library/LaunchDaemons/com.cisco.*
rm -rf /Library/LaunchAgents/com.cisco.*

# Remove Apple installer receipts to prevent software inventory false positives
pkgutil --pkgs | grep -i cisco | while read -r pkg; do
    echo "Forgetting package: $pkg"
    pkgutil --forget "$pkg" 2>/dev/null
done

echo "[*] Flushing system DNS cache..."
dscacheutil -flushcache
killall -HUP mDNSResponder

echo "[✓] Cisco VPN suite completely purged."
exit 0

4. Troubleshooting Common Cisco VPN Removal Issues

Issue / Symptom	Root Cause	Recommended Fix
Mac loses all internet and DNS connectivity after uninstallation	Umbrella DNS roaming security proxy remained active in `scutil --dns`	Run `sudo scutil --dns` and reset dynamic store keys using `networksetup -setdnsservers "Wi-Fi" empty`, then flush DNS.
System Extension remains in "terminating" state in `systemextensionsctl list`	macOS `sysextd` daemon waiting for reboot to unload active socket filter	A single reboot will clear the extension from `/Library/SystemExtensions`.
Installer fails with "Another installation is in progress"	Stale lock file in `/tmp` or active `installer` daemon	Execute `sudo killall installer` and remove `/var/run/install.pid`.

5. Frequently Asked Questions (FAQ)

Q: Why does uninstallation require a reboot on macOS?

A: Cisco AnyConnect binds low-level virtual network interfaces (utun) and system extensions. A clean restart guarantees the Darwin kernel releases all virtual socket bindings and restores default gateway routing.

Q: What is the difference between AnyConnect and Cisco Secure Client?

A: Cisco rebranded AnyConnect to Cisco Secure Client with version 5.0. It integrates AnyConnect VPN, Secure Endpoint (formerly AMP), Umbrella DNS, and ThousandEyes into a single unified agent architecture.

Script to Uninstall Cisco AnyConnect on macOS