Uninstall (standalone) - Hilt Documentation

This page covers removing a standalone install of the Hilt macOS Collector, installed from the notarized .pkg on a single Mac without MDM. Because the collector is a notarized security product with tamper protection, removal is a short, deliberate sequence: turn its extensions off, restart, then delete the app.

These steps need an administrator at the Mac. Turning off a security extension requires a local admin to authenticate; Apple does not allow it to be done silently.

Steps below are written for macOS 15 (Sequoia). On macOS 13 or 14 the layout is similar, but the extensions appear under System Settings → Privacy & Security instead of Login Items & Extensions.

Stop data collection right now

If you only need the collector to stop capturing immediately, before or instead of a full uninstall, turn its two extensions off.

Open extension settings

Go to System Settings → General → Login Items & Extensions.

Turn off the sensor

Under Endpoint Security Extensions, turn off Hilt EDR Sensor.

Turn off the network filter

Under Network Extensions, turn off Hilt EDR Network Filter. Enter an administrator password when asked.

Collection stops as soon as both are off. To remove the collector entirely, continue below.

Remove the collector

Removing the collector needs an administrator account. The last step uses Terminal and sudo. Run the steps in order.

Don’t delete the app first. While the collector is running it protects its own files, so deleting it before you turn its extensions off is blocked by design (and recorded as a tamper event). Turn the extensions off and restart first to safely disable that protection, then remove everything below.

Turn off both extensions

Turn off Hilt EDR Sensor and Hilt EDR Network Filter as shown in Stop data collection. This stops collection and disables the self-protection.

Restart the Mac

Restart so the security extensions shut down completely.

Remove the app and its background service

Open Terminal and run the following. The first command stops the forwarder LaunchDaemon that ships the sensor’s telemetry; the rest remove its launch item, the app, and its support files.

# Stop the forwarder (root LaunchDaemon)
sudo launchctl bootout system/com.hilt.edr.forwarder 2>/dev/null

# Remove the launch item, the app, and its support files
sudo rm -f /Library/LaunchDaemons/com.hilt.edr.forwarder.plist
sudo rm -rf /Applications/EDRApp.app "/Library/Application Support/Hilt"

Enter your administrator password when prompted.

Restart once more

Restart again to finish removing the two system extensions. Until this restart they stay listed but inactive. They are already turned off and collecting nothing.

Confirm it’s removed

Run these in Terminal. Each returns nothing; the ls checks may instead print “No such file or directory”:

systemextensionsctl list | grep -i hilt                       # no Hilt extensions
sudo launchctl list | grep -i hilt                            # no Hilt services
ls /Library/LaunchDaemons/com.hilt.edr.* \
   /Library/LaunchAgents/com.hilt.edr.* 2>/dev/null           # no launch items
ls -d /Applications/EDRApp.app "/Library/Application Support/Hilt" 2>/dev/null   # gone

Right after removal, systemextensionsctl list may still list the two extensions (shown as [activated disabled] or waiting to uninstall). That’s expected. They are turned off and running nothing, and they deregister completely on the next restart.

Optionally, remove the leftover Hilt EDR Sensor entry under System Settings → Privacy & Security → Full Disk Access. It is inert once the app is gone.

What happens to data already collected

Uninstalling stops all new collection immediately. Telemetry already delivered to your Hilt environment is retained per your agreement with Hilt. To review what was collected or request its deletion, contact Hilt.

Need help

Reach out to your Hilt contact or support@hilt.ai. If anything looks unexpected during removal, include the Mac’s model and macOS version and we’ll help you finish.