October 29, 2026

How to remove protected apps when using App Cleaner & Uninstaller

Q: Why can't I delete an app on my Mac?

Usually for one of four reasons: 1. The app or its background process is still running. 2. It's a system app protected by SIP and the Signed System Volume. 3. The file is locked. 4. Your uninstaller lacks App Management or Full Disk Access. Quit the app and its agents in Activity Monitor first, then check the permissions in System Settings → Privacy & Security.

Q: Can App Cleaner & Uninstaller remove built-in Mac apps like Safari?

✓ No, App Cleaner & Uninstaller follows Apple's rules and doesn't delete system apps, so macOS keeps working as it should. ✓ As a workaround, you can reset them and hide them from the Dock. ✓ To reset an app with App Cleaner & Uninstaller, turn on Show system applications in Settings → General, then right-click the app → Reset Application. By doing so, you clear caches and settings without deleting the app.

Q: Why does an uninstaller need extra permissions on Mac?

App Management is in System Settings → Privacy & Security → App Management. Without it, no third-party tool can change or delete other signed apps. For a full removal, App Cleaner & Uninstaller needs both permissions: ✓ App Management, to delete the app bundle ✓ Full Disk Access, to reach protected folders in ~/Library

Written by

A Mac specialist with a QA engineering background, focused on troubleshooting and how-to guides.

Sergio Tereshchenko

Approved by

Reviewed by a QA engineer at Nektony and Apple Certified Support Professional with hands-on experience testing Mac software.

Alex Holovchenko

When you remove applications with App Cleaner & Uninstaller, some service files and folders may refuse to go. In that case, the removal window marks each of them with an exclamation mark, so you can see exactly what stayed behind.

Below, you’ll find every common reason an app or its files won’t go, and how to fix each one. Start with the table: find your problem, then jump to the relevant section for details. As soon as you know the blocker, a complete uninstall is usually one fix away.

Go to	Symptom or message	Cause	What to do
Locked files or folders block the removal	“The operation can’t be completed because you don’t have permission to access some of the items.”	The file or folder is locked (Locked / uchg flag), or it has the wrong owner	Get Info → uncheck Locked; for folders, chflags -R nouchg, then check with ls -lO
Lack of access to protected Library folders	Exclamation marks next to files in ~/Library/Mail, Safari, Messages, Cookies, and similar	Protected Library folders; App Cleaner & Uninstaller has no Full Disk Access	Turn on Full Disk Access for App Cleaner & Uninstaller and relaunch it
The app or its background process is still running	Leftovers in ~/Library/Containers or Group Containers won’t delete (on macOS 27, with no prompt at all)	App Data protection; no Full Disk Access	Turn on Full Disk Access for App Cleaner & Uninstaller
The app or its background process is still running	“‘App’ can’t be moved to the Trash because it’s open.”	The app or its helper, agent, or daemon is still running	Quit it, stop its processes, turn off its background items
The app installed a system or kernel extension	The extension stays after the app is gone; systemextensionsctl list shows “activated enabled”	A System Extension (Network, Endpoint Security, DriverKit) is still active	Delete the host app in Finder or with its own uninstaller; on macOS 15+, remove it in Login Items & Extensions
The app installed a system or kernel extension	A .kext file is left in /Library/Extensions	A legacy kernel extension	Delete it with admin rights → sudo kmutil clear‑staging → restart
Security software blocks its own removal	An antivirus, VPN, or EDR tool blocks removal and asks you to turn off protection	Tamper protection (Endpoint Security / Network Extension)	Use the vendor’s uninstaller, then clean leftovers in App Cleaner & Uninstaller
SIP (System Integrity Protection) protects some files	“Operation not permitted” even with sudo; ls -lO shows restricted or schg	The file is protected by SIP	Try section 4 first; as a last resort, disable SIP in Recovery and turn it back on
The app’s configuration file has wrong permissions	“sudo: /etc/sudoers is world writable” (or “is owned by uid…, should be 0”); the uninstaller can’t get admin rights	Wrong permissions on /etc/sudoers	Fix the permissions in Get Info (if sudo fails) or with sudo chmod 440 and sudo chown root:wheel
The Trash folder is damaged	On every removal: “The item will be deleted immediately. You can’t undo this action.”	~/.Trash is damaged (it became a file) or has the wrong owner	Check it with ls -ld ~/.Trash → recreate the folder or fix the owner
Apps you can’t remove at all	“‘App’ can’t be modified or deleted because it’s required by macOS.”	A built‑in Apple app on the Signed System Volume	It can’t be deleted; reset it with App Cleaner & Uninstaller
Apps you can’t remove at all	The app won’t delete or comes back after removal; General → Device Management lists a profile	The app is installed and managed through MDM	Only your IT administrator can remove it

Test environment

App Cleaner & Uninstaller v.10.0.1, MacBook Pro M1, macOS Golden Gate 27.0.

Locked files or folders block the removal

If you try to remove an app with App Cleaner & Uninstaller, you may get a message that the files couldn’t be moved to the Trash because you don’t have permission to access them. Most often, the file or the folder it sits in is locked. The checkbox works the same way on every macOS from 10.14 to 27, on Intel and Apple Silicon alike.

To clear the lock on a single item:

Right‑click the file or folder → Get Info.
In the General section, find the Locked checkbox.
If it’s checked, uncheck it.
Go back to App Cleaner & Uninstaller and remove the app again.

Get Info gets tedious when a folder holds dozens of locked files inside it. In that case, Terminal clears them all in one go:

Open Terminal and paste
```
chflags -R nouchg
```
Copy
→ drag the folder into the Terminal window to paste its path → press Return.
Run
```
ls -lO <path>
```
Copy
, replacing <path> with the folder’s path, and check that uchg no longer shows up.

Note:

Two flags look alike but don’t work the same way:
- uchg (user immutable) is the Locked checkbox. You can remove it without admin rights.
- schg (system immutable) can be removed with
```
sudo chflags noschg
```
  Copy
  only when SIP is off or when you work from Recovery.
Neither flag is the same thing as the exclamation mark in App Cleaner & Uninstaller. The mark tells you the removal failed, and the flags tell you why.
On external drives formatted as exFAT or NTFS, the Locked checkbox may not appear at all. That’s a file system limit, not a lock, so the steps above won’t help there.

Lack of access to protected Library folders

Apps keep most of their service files in ~/Library, the hidden Library folder inside your home folder. Since macOS 10.14 Mojave, Apple blocks third‑party apps from changing these subfolders unless you grant them Full Disk Access:

```
~/Library/Mail
```
Copy
```
~/Library/Messages
```
Copy
```
~/Library/Safari
```
Copy
```
~/Library/Cookies
```
Copy
```
~/Library/HomeKit
```
Copy
```
~/Library/IdentityServices
```
Copy
```
~/Library/Metadata/CoreSpotlight
```
Copy
```
~/Library/PersonalizationPortrait
```
Copy
```
~/Library/Suggestions
```
Copy
iTunes and Time Machine backups
macOS 14 Sonoma added
```
~/Library/Containers
```
Copy
and
```
~/Library/Group Containers
```
Copy
to that list under App Data protection.

On macOS 14 through 26, the system asks whether an app “would like to access data from other apps.” On macOS 27 Golden Gate, the prompt is gone: access to other developers’ containers is blocked by default and managed in System Settings → Privacy & Security. XProtect can also limit access to the data of apps that malware often targets.

In practice, that means App Cleaner & Uninstaller can’t remove leftovers of sandboxed apps on macOS 27 without Full Disk Access, and nothing tells you about it.

That’s why I’d turn on Full Disk Access before anything else:

Open System Settings → Privacy & Security → Full Disk Access.
- on macOS 10.14 to 12: System Preferences → Security & Privacy → Privacy → Full Disk Access).
Turn on the toggle next to App Cleaner & Uninstaller.
Quit and reopen App Cleaner & Uninstaller. Without a restart, the new permission may not apply right away.
Try to remove the problem app again.

Note:

Terminal needs Full Disk Access as well if you plan to inspect ~/Library/Mail or ~/.Trash from the command line. Otherwise, ls returns “Operation not permitted.”

The app or its background process is still running

Plenty of apps keep working after you close their window. Menu bar agents, helper processes, and launch agents in /Library/LaunchAgents, /Library/LaunchDaemons, and ~/Library/LaunchAgents hold their files open, so macOS refuses to move them. Apple Community users run into this one a lot: the app looks closed, yet Finder insists it’s open.

Activity Monitor showing app background processes

App Cleaner & Uninstaller can close running processes on its own before it removes them, so in most cases you confirm and move on.

App Cleaner & Uninstaller showing a running app warning

App Cleaner & Uninstaller showing processes ready to close

Alternatively, you can stop it by hand:

Quit the app from its menu bar icon or Dock with Command+Q.
Open Activity Monitor → type the app name in the search field → select each related process (helper, agent, daemon) → click Stop → Force Quit.
Open System Settings → General → Login Items & Extensions → turn off the app’s toggle under Allow in the Background.
Go back to App Cleaner & Uninstaller and run the removal again.

You can also turn off the agent from the Startup Programs section of App Cleaner & Uninstaller, which saves a trip to System Settings.

Also Read:How to manage Mac startup programs

The app installed a system or kernel extension

Kernel extensions (kexts) and system extensions sound alike, but macOS handles them in very different ways. Here’s how to deal with each one.

Also Read:How to uninstall system (kernel) extensions on Mac

System extensions

Copies of system extensions sit in /Library/SystemExtensions, which SIP protects, so no app, App Cleaner & Uninstaller included, can delete them directly. The right way to remove one is to let its host app deactivate it.

App Cleaner & Uninstaller recognizes apps with system extensions and tells you about them in an info pop‑up during removal. The extension needs to be turned off in System Settings.

App Cleaner & Uninstaller showing a system extension notice

App Cleaner & Uninstaller showing system extension details

Delete the host app from /Applications in Finder or with the developer’s uninstaller. macOS shall offer to remove the extension and ask for your admin password.
On macOS 15 Sequoia and later, open System Settings → General → Login Items & Extensions → Extensions → click (i) next to Network Extensions, Endpoint Security Extensions, or Driver Extensions → turn the app’s extension off.
- On macOS 11 to 14, System Settings has no extension toggles. Drag the app from /Applications to the Trash in Finder, and macOS shall prompt you to remove the extension along with it.
Check the result in Terminal:
```
systemextensionsctl list
```
Copy
The extension should be gone or show “terminated waiting to uninstall on reboot.” In that case, restart your Mac.
Finish the removal in App Cleaner & Uninstaller.

Note:

If you delete an app with a system extension using rm -rf, the extension may stay in /Library/SystemExtensions and in the permissions list. Apple recommends removing the host app through Finder.
```
systemextensionsctl uninstall <TeamID> <BundleID>
```
Copy
works only with SIP turned off. So, try the steps above first.

Kernel extensions (.kext)

Apple has deprecated kernel extensions since macOS 11 Big Sur. Third‑party kexts are in /Library/Extensions, a folder SIP doesn’t protect, so you can delete them with your admin password and don’t need Recovery mode. Only the copies in /Library/StagedExtensions fall under SIP.

Open Finder → Go → Go to Folder.
Enter
```
/Library/Extensions
```
Copy
→ move the app’s .kext file to the Trash → enter your admin password.
Clear the staged copy macOS keeps in
```
/Library/StagedExtensions
```
Copy
(which is protected by SIP). For macOS 11+, open Terminal and run:
```
sudo kmutil clear-staging
```
Copy
Restart your Mac.

Note:

On Apple silicon Macs, a third‑party kext loads only with Reduced Security set in Startup Security Utility, so M‑series users rarely run into them.
On Intel Macs (up to macOS 26), kexts load at Full Security once you approve them in Privacy & Security.

Security software blocks its own removal

Antivirus apps, VPNs, and EDR agents protect themselves with tamper protection, built on Endpoint Security and Network Extensions. They block any removal they didn’t start and often ask you to turn off protection first. The clean route goes through the vendor:

Run the app’s own uninstaller. Look for it in the app’s menu, its folder in Applications, or on the developer’s support site.
Open App Cleaner & Uninstaller → Remains and delete whatever the uninstaller left behind.

Note:

On a work Mac, don’t remove security tools like CrowdStrike, Sophos, Symantec, or similar agents behind your IT team’s back. The MDM server reinstalls them anyway, and your Mac may be marked as non‑compliant.

SIP (System Integrity Protection) protects some files

SIP stops anyone, admins included, from changing protected parts of macOS:

```
/System
```
Copy
,
```
/usr
```
Copy
(except
```
/usr/local
```
Copy
),
```
/bin
```
Copy
,
```
/sbin
```
Copy
,
```
/var
```
Copy
,
Apple’s preinstalled apps,
```
/Library/SystemExtensions
```
Copy
, and
```
/Library/StagedExtensions
```
Copy
.

Third‑party files end up under SIP almost always through a system or kernel extension. To check whether a file is protected, open Terminal and run:

ls -lO /path/to/file

Copy

The restricted flag means it’s protected by SIP. Turning SIP off is a last resort.

Before you go there:

Work through the Extensions section above, since it removes most protected third‑party files with SIP left on.
Run
```
csrutil status
```
Copy
in regular Terminal to check whether SIP is on in the first place.
Keep in mind that SIP has nothing to do with built‑in Apple apps: since macOS 11, they sit on a read‑only Signed System Volume, and you can’t delete them even with SIP off.

If you still need it, the steps are below.

Note:

On Apple Silicon, a Mac with SIP off runs at Permissive Security, and iPhone and iPad apps won’t launch until you turn SIP back on.
Never run sudo rm -rf on paths in /System or /Library/Extensions without double‑checking them. One typo there can leave your Mac unable to boot.
Make sure you understand which files you’re deleting. If you aren’t sure, don’t turn SIP off. But if you’ve decided to do so, enable SIP back once you are done.

To disable SIP on Apple Silicon (macOS 11 to 27):

Shut down your Mac.
Press and hold the power button until you see Loading startup options.
Click Options → Continue → select your admin account → enter its password.
In the menu bar, click Utilities → Terminal.
Type the command below → press Return:
```
csrutil disable
```
Copy
Confirm → enter your admin credentials if Terminal asks.
Restart your Mac → delete the problem files.

If Recovery returns “csrutil: failed to modify system integrity configuration,” the usual cause is a skipped step: selecting the admin user or entering its password.

To disable SIP on Intel (macOS 11 to 26):

Restart your Mac and hold Command+R until the Recovery screen appears. Macs with a T2 chip work the same way; if you set a firmware password, enter it when asked.
Click Utilities → Terminal → type
```
csrutil disable
```
Copy
→ press Return.
Restart and delete the problem files.
Once you’re done, turn SIP back on. Repeat the same Recovery steps, run
```
csrutil enable
```
Copy
, and restart.

The app’s configuration file has wrong permissions

App Cleaner & Uninstaller asks for your admin password to remove system‑level files. If the permissions of the sudoers configuration file are wrong, it can’t get admin rights, and you may see “sudo: /etc/sudoers is world writable” or “is owned by uid…, should be 0.”

To restore the correct permissions in Finder, the steps are below. FYI, here is the thing:

The default is read‑only for root and wheel and no access for everyone else (-r--r-----, mode 0440). It stays the same on every macOS from 10.14 to 27.

Check it first:

Open Terminal and run
```
ls -l /private/etc/sudoers
```
Copy
The line should start with -r--r----- and show the root wheel.

If it doesn’t, run:

sudo chmod 440 /private/etc/sudoers

Copy

then

sudo chown root:wheel /private/etc/sudoers

Copy

If sudo has stopped working, fix the permissions in Finder instead:

Open Finder → Go → Go to Folder → type
```
/etc
```
Copy
→ press Return.
- ```
/etc
```
  Copy
  points to
```
/private/etc
```
  Copy
  , and the shortcut still works on macOS 27.
Note:

Never edit the contents of sudoers in a text editor. Use sudo visudo if you ever need to change it. A broken sudoers file stops sudo from working at all.
Right‑click sudoers → Get Info → in Sharing & Permissions, click the lock icon and enter your admin password.
Set the permissions as follows:
- system to Read only
- wheel to Read only
- everyone to No access
Click the lock again.
Then return to App Cleaner & Uninstaller and run the removal again.

The Trash folder is damaged

If every removal ends with “The item will be deleted immediately. You can’t undo this action,” your Trash has a problem. That happens when the hidden ~/.Trash folder turns into a file or gets the wrong owner, usually after migrating from another Mac. To fix that, here are Terminal and Finder steps:

Run a check in Terminal with this command:
```
ls -ld ~/.Trash
```
Copy
- A healthy Trash shows drwx------ and your username.
If .Trash turned into a file, run:
- ```
rm ~/.Trash
```
  Copy
  (this deletes a broken .Trash file), then
- ```
mkdir ~/.Trash
```
  Copy
  (this creates a new empty .Trash folder in your home directory), and
- ```
chmod 700 ~/.Trash
```
  Copy
  (this sets the folder’s permissions)
- Relaunching Finder rebuilds the folder too. Terminal needs Full Disk Access for this, or it returns “Operation not permitted.”

If you prefer using Finder, this is your way:

Open your home folder → press Command+Shift+. to show hidden items.
Delete the file named .Trash (make sure it’s a file, not a folder).
Press Command+Shift+. again to hide them. The shortcut works from macOS 10.12 through 27.

If .Trash has the wrong owner, make yourself the owner by running this command in Terminal:

sudo chown $(whoami) ~/.Trash

Copy

Note:

After the Trash works again, open App Cleaner & Uninstaller Settings → Remove tab → make sure Delete items permanently is off, so removed files go to the Trash and you can still restore them.

App Cleaner & Uninstaller showing Remove settings

Apps you can’t remove at all

Two kinds of apps stay no matter which tool you use. This is a macOS limitation, not an App Cleaner & Uninstaller one.

Built-in Apple apps

Safari, Mail, Music, Maps, FaceTime, and other preinstalled apps live on the read‑only Signed System Volume, a sealed, read‑only part of the disk.
Finder says the app “can’t be modified or deleted because it’s required by macOS,” and turning off SIP doesn’t change that.
Even when people force the removal, the Delete option for FaceTime stays grayed out, and deleted system apps return with the next macOS update.

What you can do is reset a built‑in app, which clears its caches and settings in ~/Library but keeps the app:

Open App Cleaner & Uninstaller.
Go to Settings → General → turn on Show system applications.
In the main window, right‑click the Apple app → Reset Application → confirm.

Also Read:How to delete default Mac apps

Apps managed by your organization (MDM)

On work or school Macs, an MDM profile may block removal or put an app right back after you delete it. To check, open System Settings → General → Device Management. If you see a profile there, only your IT administrator can remove the app.

Clean up leftovers after a failed removal

If the app is gone but some of its files failed to delete, you don’t have to start over. Fix the cause from the sections above, then:

Open App Cleaner & Uninstaller → switch to the Remains tab.
Select the leftovers of the removed app → click Remove.

Final fix

Most removal errors come down to a missing permission or a process that won’t quit, and those take a minute to fix. SIP and Recovery mode come last, and built‑in Apple apps don’t come off at all.

Still stuck? Contact our support. To speed things up, include:

Your macOS version (run
```
sw_vers
```
Copy
in Terminal)
Your App Cleaner & Uninstaller version
A screenshot of the error
The output of
```
systemextensionsctl list
```
Copy
, if an extension is involved

Frequently asked questions

Why can't I delete an app on my Mac?

Usually for one of four reasons:

The app or its background process is still running.
It's a system app protected by SIP and the Signed System Volume.
The file is locked.
Your uninstaller lacks App Management or Full Disk Access.

Quit the app and its agents in Activity Monitor first, then check the permissions in System Settings → Privacy & Security.

Can App Cleaner & Uninstaller remove built-in Mac apps like Safari?

No, App Cleaner & Uninstaller follows Apple's rules and doesn't delete system apps, so macOS keeps working as it should.
As a workaround, you can reset them and hide them from the Dock.
To reset an app with App Cleaner & Uninstaller, turn on Show system applications in Settings → General, then right‑click the app → Reset Application. By doing so, you clear caches and settings without deleting the app.

Why does an uninstaller need extra permissions on Mac?

App Management is in System Settings → Privacy & Security → App Management. Without it, no third‑party tool can change or delete other signed apps. For a full removal, App Cleaner & Uninstaller needs both permissions:

App Management, to delete the app bundle
Full Disk Access, to reach protected folders in ~/Library