Uninstall Little Snitch Command Line

Posted By admin On 09.01.21
Learning has never been so easy!
  1. Dec 14, 2016 Little Snitch is a very excellent app favored by macOS users, and the latest version of Little Snitch is compatible with macOS Sierra that was released some time ago. To install it smoothly, first you should remove the old version of Little Snitch. But not all macOS users know how to completely remove Little Snitch.
  2. Jan 31, 2020  Step 2: After moving the Little Snitch 4 application file to Trash, these are still Little Snitch 4 related firewall engines, firewall settings, and other 'Hidden' components. To get rid of all these Little Snitch 4 leftovers, you need to move further: Open Finder in Menu, click Go enter /Library/.

The wusa command allows admins to uninstall specific Windows Updates from a CMD prompt or by use of a batch file.

Oct 02, 2013 After the process is finished, you will have to restart your computer. If you enable the option to remove rules and settings, the Uninstaller will delete all your system-wide configuration and rules files (also any Little Snitch 2 files), including the file that stores your license information.

I have found this useful to remove IE Cumulative Security Updates that cause compatibility issues with legacy Java applications, and will use the KB for an IE 8 Cumulative Security Update as an example.

3 Steps total

Step 1: Locate KB number of the patch you wish to uninstall

Open Programs and Features from the Control Panel of a system that has the desired update installed and click 'View Installed Updates' and locate the update. The KB number will be listed in parenthesis at the end of the name.

Step 2: Open CMD Prompt or Notepad

These commands can be run directly from the CMD prompt, or can be saved as a .bat file from notepad for use on multiple machines. I recommend creating a .bat file and changing the KB number as needed.

Snitch

This will run the uninstall without any open windows, and will not prompt for a reboot:

@echo off
wusa /uninstall /kb:2744842 /quiet /norestart
END

If you are manually running the script on a number of computers that you want to reboot after the uninstall, just change the /norestart switch to /forcestart:

@echo off
wusa /uninstall /kb:2744842 /quiet /forcestart
END

Step 3: Block the undesired update from installing on the PC

This will vary based on your patch management. If using WSUS, you will need to block the patch there, or if each PC is receiving automatic updates, you will need to block the patch by opening Control Panel --> Windows Updates and checking for updates, then right click the undesired update and choose to hide it.

Uninstall Little Snitch Command Line Download

References

  • Microsoft Description of the WUSA Command
Little

15 Comments

  • Pimiento
    aleksandarblagojevic2 Apr 5, 2015 at 09:31pm

    YES THIS WORKS BUT WITHOUT 'END'
    @echo off
    wusa /uninstall /kb:/quiet /norestart
    Thanks a Lot !!!

  • Poblano
    danstevenson2 Nov 11, 2015 at 10:23pm

    Thanks for the info! Just came across this after the latest updates starting causes crashes for some of our Outlook users. Here is a simple bat script to check for and uninstall an update that is causing problems, just replace the KB number with the number of the one you need to uninstall:

    Now that Microsoft released a fixed version of KB3097877 uninstalling shouldn't be necessary but I updated my original script to show how to completely remove the packages left behind so an update wouldn't automatically get reinstalled after the next boot. The script assumes the current user is administrator but could be edited for any user. This may come in handy for the next update that MS botches :-)

    @echo off
    if exist c:windowsservicingpackagespackage_for_KB3097877* (
    echo Found updates that must be removed, please wait..
    wusa /uninstall /kb:3097877 /quiet /norestart
    takeown /F c:windowsservicingpackages*KB3097877*.*
    icacls c:windowsservicingpackages*KB3097877*.* /grant Administrator:D
    del c:windowsservicingpackages*KB3097877*.*
    shutdown /r /f /t 60 /c 'Windows will restart in one minute, save your work and close your files now!'
    ) ELSE (
    echo No updates need to be removed
    )

  • Anaheim
    Danny in San Jose Nov 12, 2015 at 08:35pm

    Also found this looking for a way out of the KB3097877 issue. Works great! Dan Stevenson's version gives your users 1 minute to close everything prior to reboot.

  • Habanero
    Lauren7060 Nov 13, 2015 at 02:53pm

    I am trying to remove KB3097877 using WinPE command line and the wusa /uninstall /kb:3097877. When I run this I get the error The subsystem needed to supper the image type is not present. Ideas?!?

  • Poblano
    danstevenson2 Nov 13, 2015 at 03:05pm

    Lauren7060
    I'm not very familiar with WinPE, maybe this thread will help:
    https://social.technet.microsoft.com/Forums/windows/en-US/3895ebb4-c8b8-41b8-a63d-27fe61a6102e/windows-7-64-bit-deployment-using-imagex-the-subsystem-needed-to-support-the-image-type-is-not

  • Pimiento
    TEKinaka Nov 13, 2015 at 06:15pm

    danstevenson2 - Thanks for the script! Works beautifully. We ran into the Outlook problem on Windows 7 systems too, mostly on computers that are not checking in with WSUS (remote laptops, etc).

    One thing i'd like to add to your script is the PAUSE option at the bottom past the end closing parenthesis.

    Not sure if this happens on everyone's systems, but on my test computer if KB3097877 is not installed the CMD window just closes instantly and users / support staff never see the 'No updates need to be removed'. With the PAUSE there you get a press any key to continue message which is end user friendly :-)

  • Poblano
    danstevenson2 Nov 13, 2015 at 06:27pm

    aaronekinaka - Thanks for the feedback, it's much appreciated :-)

    I didn't add a pause to the script because in our environment this script was just being called by our primary login script and I try to keep user interaction to a minimum. I really only added the 'No updates needed to be removed' for myself so I could see if the script was working. Of course there is no harm in adding a pause if you like to see the message. :-)

  • Pimiento
    TEKinaka Nov 13, 2015 at 06:54pm

    ^^^ touche! Logon script would be best for quick removal using a GPO. Thanks again for doing the legwork on this one, i'll keep this bat file handy for any future KB's that need to be pulled quickly.

  • Sonora
    Eddie760 May 11, 2016 at 01:51pm

    with this script from danstevenson2
    I get the error that it cannot delete the c:windowsservicingpackages..
    even I login as Admin full right.

    @echo off
    if exist c:windowsservicingpackagespackage_for_KB2868116* (
    echo Found updates that must be removed, please wait..
    wusa /uninstall /kb:KB2868116 /quiet /norestart
    takeown /F c:windowsservicingpackages*KB2868116*.*
    icacls c:windowsservicingpackages*KB2868116*.* /grant Administrator:d
    del c:windowsservicingpackages*KB2868116*.*
    shutdown /r /f /t 60 /c 'Windows will restart in one minute, save your work and close your files now!'
    ) ELSE (
    echo No updates need to be removed
    ) /header-file-for-sleep-in-dev-c.html.

    C:windowssystem32>c:2868116
    Found updates that must be removed, please wait..

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat' now owned by user 'EB121STU21X2421$'.

    SUCCESS: The file (or folder): 'c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum' now owned by user 'EB121STU21X2421$'.
    processed file: c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    processed file: c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    processed file: c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    processed file: c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    processed file: c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.mum
    processed file: c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    processed file: c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Successfully processed 12 files; Failed processing 0 files
    c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_2_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_38_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_40_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_9_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_for_KB2868116_SP1~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Access is denied.
    c:windowsservicingpackagesPackage_for_KB2868116~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Access is denied.
    C:windowssystem32>

  • Poblano
    danstevenson2 May 11, 2016 at 02:23pm

    Eddie760,

    Try replacing 'Administrator' with your user name in the line:
    icacls c:windowsservicingpackages*KB2868116*.* /grant Administrator:d

    When I created the script I was logged in using the built in Administrator account.

  • Thai Pepper
    Capef3ar Jun 24, 2016 at 02:02pm

    Thanks for the great write up; helped out a lot!

  • Pimiento
    ITJoeIT Jun 24, 2016 at 04:01pm

    What if you need to add it to shared logon scripts and all the users do not have admin privileges? Any way around that?
    Thanks!

  • Poblano
    danstevenson2 Jun 24, 2016 at 06:13pm

    ITJoeIT,

    Maybe the post by Lauren7060 in this thread will help:

    https://community.spiceworks.com/topic/368007-runas-batch-including-password?page=1

  • Pimiento
    ronboswell Jul 19, 2016 at 03:27pm

    Computer startup scripts run with local admin rights by default, so I would just run it as a startup script instead of a login script.

  • Thai Pepper
    FelipePena Jul 24, 2018 at 04:50pm

    Very useful tool for removing a specific update. it's lot more straight forward than drilling down the list of updates looking for the KB numbers.
    Thanks Ed

I cannot uninstall Little Snitch with the uninstall command in the installer.
I have NOT manually removed any pieces of Little Snitch.

How To Uninstall Little Snitch Mac


I read relevant forums, and following instructions, I have downloaded the LS 2.0.1 installer, run the uninstall command (three times) with a restart between each try, and no effect, LS still installed and in control.
I have tried to install/upgrade my 2.0 version using the Little Snitch 2.0.1 installer (that I was using for the uninstall command), and THEN run the uninstall, STILL unsuccessful. The version of the Little Snitch Configuration application did not change after running the 2.01 installer, the LS config app stayed at version 2.0 (136).

Uninstall Little Snitch Command Line Full


Little Snitch

I am using OS X 10.4.10. Any advice would be appreciated.