The Death of Kernel Extensions (Kexts)
For decades, developers who needed deep, low-level access to the macOS operating system—such as endpoint security software (CrowdStrike, SentinelOne), network firewalls (Little Snitch), or advanced audio drivers—relied on Kernel Extensions (Kexts). Kexts ran in “ring zero,” sharing the exact same memory space as the macOS kernel.
While this provided immense power, it was a massive security and stability risk. A single poorly coded Kext from a third-party vendor could cause a catastrophic kernel panic, instantly crashing the entire Mac.
Starting with macOS Catalina (10.15) and strictly enforced in macOS Big Sur (11.0), Apple deprecated third-party Kernel Extensions in favor of System Extensions. System Extensions provide the same necessary low-level access but run entirely in user space. If a System Extension crashes, it only crashes itself, leaving the core macOS kernel completely unaffected.
To manage these modern, highly secure extensions from the terminal, administrators use the systemextensionsctl command.
Step 1: Viewing Installed System Extensions
Unlike standard applications, System Extensions run invisibly in the background. If a security agent or VPN client is failing to load, the first troubleshooting step is to verify if macOS actually recognizes and has loaded its associated System Extension.
Open the Terminal and run the list command:
systemextensionsctl listThe output is categorized into different subsystem types:
- Network Extensions: VPNs, packet filters, and firewalls.
- Endpoint Security Extensions: Antivirus and EDR agents.
- Driver Extensions (DriverKit): USB, audio, and hardware drivers.
Next to each extension, you will see its state. An extension might be listed as [activated enabled], meaning it is running perfectly. However, if it says [activated waiting for user], it means the extension has been installed but the user has not yet gone into System Settings to click the “Allow” button.
Step 2: Understanding User Consent and MDM
A major security feature of System Extensions is User Approved Kernel Extension Loading (UAKEL). When a developer installs a new System Extension, macOS halts it and presents a pop-up to the user stating “System Extension Blocked.” The user must manually navigate to System Settings > Privacy & Security and explicitly approve the developer’s Team ID.
In an enterprise environment, relying on users to click “Allow” for critical security software is unacceptable. Therefore, IT administrators must use a Mobile Device Management (MDM) solution (like Jamf or Intune) to push a SystemExtensionPolicy configuration profile.
This profile pre-approves specific Apple Team IDs (e.g., X9E956P446 for CrowdStrike) and allows the extensions to load silently without prompting the end-user.
Step 3: Uninstalling a Stubborn System Extension
Because System Extensions run outside the kernel, they are tied directly to the application that installed them. If you drag the host application from the Applications folder to the Trash, macOS is supposed to automatically unload and delete the corresponding System Extension.
However, this process occasionally breaks, leaving an orphaned System Extension permanently running in the background.
To forcefully remove a broken System Extension, you must use systemextensionsctl. First, locate the specific Team ID and Bundle Identifier from the list command output (e.g., com.vendor.security.extension).
Then, run the uninstall command:
sudo systemextensionsctl uninstall [Team ID] [Bundle Identifier]Example:
sudo systemextensionsctl uninstall X9E956P446 com.crowdstrike.falcon.AgentStep 4: The SIP Restriction
If you attempt to run the uninstall command on a modern Mac, you will likely encounter an error stating that the operation is blocked by System Integrity Protection (SIP).
To prevent malware from disabling your antivirus by forcefully uninstalling its Endpoint Security System Extension, Apple heavily restricts the systemextensionsctl command. By default, even the root user cannot arbitrarily uninstall active System Extensions via the terminal.
To forcefully uninstall an extension during extreme troubleshooting, you must boot the Mac into macOS Recovery, disable SIP, reboot, run the uninstall command, boot back into Recovery, and re-enable SIP.
# Inside macOS Recovery Terminal
csrutil disable
reboot
# In normal macOS Terminal
sudo systemextensionsctl uninstall X9E956P446 com.vendor.broken.app
# Inside macOS Recovery Terminal
csrutil enable
rebootBecause of this immense friction, it is absolutely critical that developers include robust uninstaller scripts within their applications that properly request the OS to deregister the extension.
Conclusion
The transition from Kernel Extensions to System Extensions represents a monumental leap forward in macOS stability and security. While systemextensionsctl provides administrators with deep visibility into exactly which low-level drivers and security agents are running in user space, Apple’s strict enforcement of SIP and MDM profiles ensures that these critical system components cannot be tampered with maliciously.