macOS - Software - Uninstall Splashtop Streamer

What the Splashtop Streamer macOS uninstaller does

This Automox Worklet™ removes Splashtop Streamer from macOS endpoints in a single policy run. The Worklet targets every artifact the installer leaves behind. That includes the application bundle at /Applications/SplashtopStreamer.app, the launch daemons under /Library/LaunchDaemons, the launch agents under /Library/LaunchAgents, the preferences and support files in /Library/Application Support and /Library/Preferences, and the installer receipts tracked by pkgutil.

The remediation script runs Splashtop's bundled uninstaller first when it is present, then falls back to a deterministic teardown. It stops the running streamer process and calls launchctl unload on com.splashtop.streamer.plist and the related agent plist. The script then deletes the application bundle, removes the support directories, clears the cached preferences, and forgets the package receipts with pkgutil --forget. The Worklet handles the case where the bundled uninstaller is missing or has been damaged by a previous failed removal.

The evaluation script is non-destructive. It only inspects the endpoint for the application bundle, the launch daemon plist files, and the pkgutil receipts. The Worklet returns a non-compliant exit code when any indicator is present, which lets you schedule the policy on a recurring cadence without re-running the remediation against endpoints that are already clean.

Why remove Splashtop Streamer from macOS endpoints

Splashtop Streamer is a legitimate unattended remote access agent, but its presence on a managed Mac fleet is rarely accidental and often unwanted. A returning contractor's laptop, an acquired company's hardware, or a developer workstation loaned out for a one-off support session all surface the same residue. An active streamer service listens for inbound sessions, launch daemons survive reboots, and pkgutil receipts hide the install from a casual ps or Applications folder check. Leaving the agent on the endpoint extends the attack surface, conflicts with the organization's sanctioned remote support tool, and creates duplicate authentication paths the security team did not approve.

Scheduling this Worklet against the Mac group strips Splashtop Streamer from every endpoint a policy targets by removing the /Applications/Splashtop Streamer.app bundle, unloading the com.splashtop.streamer LaunchDaemon, and forgetting the pkgutil receipts. The next evaluation verifies the result against the same three indicators, and if a user reinstalls the agent from a backup or a stale image, the next agent check-in catches and re-runs the cleanup automatically.

How Splashtop Streamer removal works on macOS

1. Evaluation phase: The Worklet runs three independent checks. It tests for the bundle directory /Applications/SplashtopStreamer.app, it lists /Library/LaunchDaemons and /Library/LaunchAgents for com.splashtop.streamer.plist and com.splashtop.streamer-agent.plist, and it runs pkgutil --pkgs | grep -i splashtop to surface any installer receipts. If any of the three checks returns a positive result, the script exits non-zero and Automox schedules remediation. If all three checks come back clean, the script exits 0 and the endpoint is reported compliant.

2. Remediation phase: The remediation script invokes /Applications/SplashtopStreamer.app/Contents/Resources/uninstall.sh when the bundled uninstaller exists. It then runs pkill -f SplashtopStreamer to terminate the streamer process, launchctl unload /Library/LaunchDaemons/com.splashtop.streamer.plist, and launchctl unload /Library/LaunchAgents/com.splashtop.streamer-agent.plist. The script then removes /Applications/SplashtopStreamer.app, /Library/Application Support/Splashtop, /Library/Preferences/com.splashtop.streamer.plist, and the matching daemon and agent plist files. Finally, it walks the output of pkgutil --pkgs | grep -i splashtop and calls pkgutil --forget on each package identifier so the system no longer reports Splashtop Streamer as installed.

Splashtop Streamer removal requirements

• macOS 10.13 (High Sierra) or later, including Apple Silicon endpoints

• Root or sudo privileges so the Worklet can unload launch daemons and write to /Library (the Automox agent already runs in this context)

• Full Disk Access granted to the Automox agent so launchctl unload and the /Library cleanup steps complete without TCC prompts

• Bash or zsh present at /bin/bash (default on every supported macOS release)

• An optional MDM removal of any management profile that re-deploys Splashtop Streamer; without this, the agent will reinstall on the next MDM check-in and the next Worklet evaluation will flag the endpoint again

Expected macOS endpoint state after Splashtop removal

Run ls /Applications | grep -i splashtop after the policy completes. The command returns nothing. Run launchctl list | grep -i splashtop and pkgutil --pkgs | grep -i splashtop for parity; both also return empty. The streamer process is no longer listed in ps -ef | grep -i splashtop, no inbound listener remains on the streamer's session port, and the Console.app shows no further log entries from com.splashtop.streamer.

Subsequent Automox policy runs report the endpoint as compliant without re-running remediation, because the evaluation script finds no bundle, no plist, and no pkgutil receipt. If a user reinstalls Splashtop Streamer manually or restores it from a Time Machine backup, the next evaluation flags the endpoint and the Worklet removes it again. For audit evidence, capture the activity log entry for the policy run and the post-remediation output of pkgutil --pkgs | grep -i splashtop, and attach both to the ticket that authorized the removal.