I used the System Settings method on macOS 15 or Tahoe, but the extension is still active. Why?

✓ Check with systemextensionsctl list in Terminal to confirm it's still active.n✓ If the system extension shows 'terminated waiting for uninstall on reboot,' restart your Mac. The system will automatically remove the extension's registration during the reboot.n✓ If the extension is still active after removing it through System Settings and restarting your Mac, you can use Method 2 (temporarily disabling SIP and removing it directly) as a fallback.

Is it safe to disable SIP to remove a kext?

Yes, as long as you re-enable it immediately afterward. SIP disablement is not permanent and is reversed in Method 2's final step. The risk is limited to the window between disabling SIP and re-enabling it: during that period, other processes could also modify protected system areas. Keep that window short.

How do I know if I have a kernel or system extensions installed?

There are a few ways to check if your Mac has kernel or system extensions installed:n✓ In Terminal, run kextstat | grep -v com.apple to list loaded third-party kexts. If you get no output, there are no third-party kexts currently loaded.n✓ On macOS Catalina (10.15) and later, run systemextensionsctl list to see installed System Extensions. These have largely replaced kexts and are commonly used by antivirus, VPN, and other security apps.n✓ You can also check System Settings → Privacy & Security, where macOS lists allowed extensions and may show alerts for blocked extensions that require your approval.

August 12, 2026

How to remove kernel extensions and system extensions on Mac

Written by

A Mac specialist with a QA engineering background, focused on troubleshooting and how-to guides.

Sergio Tereshchenko

Approved by

Reviewed by a QA engineer at Nektony and Apple Certified Support Professional with hands-on experience testing Mac software.

Alex Holovchenko

When you remove an app with App Cleaner & Uninstaller, a few service files sometimes remain and get flagged as ‘pending removal.’
In most cases, that’s because the app installed a System Extension or a kernel extension (kext, the legacy mechanism).
macOS deliberately protects both types from removal by third-party apps, so clearing them takes one extra manual step.

Which step depends on your macOS version and what you are going to remove:

On macOS 15+, System Extensions can be removed straight from System Settings.
On macOS 11-14, the only route is to remove kernel extensions (kext) and system extensions by temporarily disabling SIP.

In this guide, I’ll cover both cases, explain the extensions theoretically, and show you how to remove them practically, supporting you with detailed instructions.

Method	Works on	Extension types	Requires Terminal
System Settings	macOS 15 and later	Network, Endpoint Security, DriverKit	No
Disable SIP	macOS 11 through 14	.kext files, any System Extension (fallback)	Yes

This article contains:

Kernel extensions vs. System Extensions: what’s the difference
Method 1: Remove a system extension via System Settings (macOS 15+)
Method 2: Remove kext and system extensions by disabling SIP (macOS 11-14)
FAQs

Kernel extensions vs. System Extensions: what’s the difference

Kexts run inside the kernel itself with full system privileges; System Extensions run in user space with only the access they need. As a result, kexts and System Extensions are blocked by two different systems, which is why they need two different removals.

Feature	Kernel extension (kext)	System Extension
What blocks removal	SIP (System Integrity Protection)	System Settings permission model
Categories	Legacy drivers and low-level system hooks	Network Extension, Endpoint Security, DriverKit, File System
Typical source	Old security and utility software	Modern antivirus, firewalls, VPN

No third-party tool can remove either type directly. When App Cleaner & Uninstaller can’t finish the job, it flags the leftover as ‘pending removal ’ rather than pretending it’s gone:

App Cleaner & Uninstaller showing pending removal popup

When Apple switched from kernel extensions to System Extensions

Apple announced the transition at WWDC 2019 and deprecated kexts officially at that point. Apple introduced the System Extensions and DriverKit frameworks to replace them. The rollout was gradual across several macOS versions:

Kernel extensions haven’t been formally removed from macOS.
But Apple’s position is as follows: ‘Kexts are no longer recommended for macOS. Kexts risk the integrity and reliability of the operating system.’
In practice, that means kext-based software is increasingly the exception: most antivirus tools, VPNs, and firewalls now ship as System Extensions instead.

Method 1: Remove a system extension via System Settings (macOS 15+)

Use this method if you are on macOS 15 Sequoia or macOS 26/27 Tahoe and are removing the three System Extension categories, and only these - it can’t touch a kext:

Network Extensions: used by firewalls, VPNs, and network filters/proxies to inspect and filter traffic.
Endpoint Security Extensions: used by antivirus and EDR/XDR tools to monitor system events like process launches and file access.
DriverKit Extensions: used by device and file system drivers.

Steps for macOS 15 and later

Open System Settings → General → Login Items & Extensions.
Scroll to the Extensions section → click the ⓘ icon next to the relevant category (for example, Network Extensions).
Find the app in question → click the ⋯ icon next to it → choose Delete Extension.

Note:

On macOS 15 (unlike macOS 26/27), there is no separate ‘By Category’ toggle in this screen; extension categories open directly, but the removal pattern is the same.

Empty the Trash. A System Extension can keep running from the Trash until it is emptied; this is a required step, not optional.
Restart your Mac. The extension is fully removed after the restart.

Method 2: Remove kext and system extensions by disabling SIP (macOS 11-14)

Use this method in three situations:

For legacy .kext files, which Finder refuses to move to Trash on any macOS.
For System Extensions (Network, Endpoint Security, DriverKit) on macOS 11-14, where no GUI removal option exists at all.
For System Extensions on macOS 15 and later, as a fallback: if deleting the extension through System Settings and restarting didn’t fully clear it.

All three cases require temporarily turning SIP off.

Important!

Disabling SIP lowers your Mac’s security. Only do this when you are confident the extension is safe to remove, and re-enable SIP immediately afterward (see how below). Don’t leave it disabled longer than needed.

What is SIP

SIP (System Integrity Protection) is a macOS security technology introduced in macOS 10.11 El Capitan. It protects critical system files and processes from modification, including by the root user. SIP blocks changes to specific system folders and components, preventing even privileged processes from altering them.

SIP is also the reason some third-party apps, e.g., antivirus tools, VPN clients, firewalls, and disk utilities chief among them, install kernel extensions in a way that can’t be removed directly.

A leftover .kext file can affect system behavior even after you’ve deleted the app itself. Removing it fully means temporarily disabling SIP, deleting the file by hand, then turning SIP back on.

Steps for macOS 11-14

Restart your Mac into Recovery Mode.
- On Apple Silicon: shut down your Mac → press and hold the power button until ‘Loading startup options’ appears. Click Options → click Continue.
- On Intel: restart your Mac → immediately hold Command + R until the Apple logo appears.
From the menu bar, choose Utilities → Terminal.
Disable SIP by typing the following command and pressing Return:
```
csrutil disable
```
Copy
Confirm by typing y and pressing Return. Enter your administrator password when prompted.
Restart your Mac in normal mode.
Remove the extension. The exact step depends on what you are removing:

For a .kext file:
- Open Finder → press Shift+Command+G.
- Go to
```
/Library/Extensions/
```
  Copy
  and
```
/System/Library/Extensions/
```
  Copy
- Locate the extension → move it to Trash.
For a System Extension (Network, Endpoint Security, or DriverKit) on macOS 11-14:
- Open Terminal.
- To find the teamID and bundleID of the extension, run the following command:
```
systemextensionsctl list
```
  Copy
- Remove the extension by entering this command:
```
sudo systemextensionsctl uninstall <teamID> <bundleID>
```
  Copy
  Replace <teamID> and <bundleID> with the values from the list output.
Empty the Trash (for .kext removals) and restart your Mac to complete the removal.
Turn SIP back on. Restart into Recovery Mode again, open Terminal, and run:
```
csrutil enable
```
Copy
Restart your Mac one more time for the change to take effect.

Final catch-up: Which method to use

So, macOS deliberately protects both kernel extensions and System Extensions. That’s why you’ve got two methods to remove them:

Use Method 1 if you are on macOS 15 or later, where you can remove System Extensions directly from System Settings, followed by emptying the Trash and a restart.
Use Method 2 if you are on macOS 11–14, where the switch doesn’t exist, and you are supposed to remove legacy kexts (kernel extensions) through a temporary SIP disable instead.

Both methods target only protected extension types that the system itself controls. For everything else an app leaves behind, including whole apps, App Cleaner & Uninstaller handles the cleanup without any manual steps.