"Service is disabled" message when attempting to launch the SEDR CollectionServiceAgent daemon on macOS

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

Symantec Endpoint Detection and Response's Mac CSA daemon will not launch, even after an uninstall and reinstall of the CSA daemon. When attempting to launch the daemon manually using launchctl a message stating that the "Service is disabled" is received.

"Service is disabled"

Cause

In this case the service has been disabled and cannot launch until the service is re-enabled. This is likely the result of the service having been unloaded using launchctl in conjunction with the -w switch, which will disable the service. This condition can remain even if the software is uninstalled and reinstalled

Resolution

Re-enable the disabled service using the following command:

sudo launchctl load -w /Library/LaunchDaemons/com.Symantec.CollectionServiceAgent.Daemon.plist

You may be prompted to enter your password when running these commands. In some cases it is recommended you reboot the system after re-enabling the services to ensure everything loads correctly at boot.