How to Uninstall Cisco Secure Client

Cisco Secure Client—the next-generation evolution of Cisco AnyConnect Secure Mobility Client—is widely deployed on enterprise and academic endpoints to provide virtual private network (VPN) connectivity, DNS layer security, and endpoint telemetry. However, when you leave an organization, decommission a device, or migrate to a different network architecture, removing the client becomes necessary.

Because Cisco Secure Client installs as a modular suite that deeply integrates with operating system network stacks, virtual adapters, and system extensions, uninstallation is not always as simple as dragging an icon to the Trash or clicking a single button. This guide covers everything you need to know about removing Cisco Secure Client safely, including what the software does, official vendor removal guidelines, step-by-step procedures for Windows and macOS, automated scripts for IT administrators, and fixes for common access errors.

What Cisco Secure Client Does and When It Is Safe to Remove

Frequently Asked Questions

What is Cisco Secure Client, and what does it do on my device?
Cisco Secure Client (formerly Cisco AnyConnect) is an enterprise endpoint security suite. Rather than acting as a simple VPN tunnel, it functions as a modular host for multiple corporate security tools, including:
* AnyConnect Core VPN: Routes network traffic securely to private enterprise networks.
* Cisco Umbrella Roaming Security: Enforces cloud-delivered DNS-layer protection and web filtering.
* Cisco Secure Endpoint (formerly AMP): Detects, blocks, and analyzes malware threats on the device.
* Network Visibility Module (NVM): Collects endpoint traffic telemetry for corporate monitoring.
* ISE Posture / HostScan: Checks device compliance (such as disk encryption and antivirus status) before granting network access.
* DART (Diagnostics and Reporting Tool): Gathers troubleshooting logs for IT help desks.

Is it safe to uninstall Cisco Secure Client from my personal computer?
Yes. If you installed Cisco Secure Client on a personally owned computer for temporary remote access (such as for university classes or a past employer) and no longer require access to those internal networks, you can safely remove it. Doing so unbinds virtual network adapters and frees local system resources without negatively affecting your standard internet browsing.

What happens if I remove Cisco Secure Client from a company-issued device?
Removing the software from a corporate-managed device will break remote access to internal resources, including intranet portals, private file shares, and internal development environments. Furthermore, if your company enforces Zero Trust Network Access (ZTNA) or endpoint compliance checks via Cisco ISE Posture, uninstalling the client will trigger a non-compliant flag, potentially locking you out of cloud apps such as corporate email, single sign-on (SSO) dashboards, and productivity suites. If you are on an active work device, consult your IT department before proceeding.

Official Cisco Uninstallation Architecture and Requirements

According to Cisco Secure Client documentation (Release 5.x and later), the client is architected as an umbrella framework managing several decoupled sub-packages. Vendor-supported removal procedures mandate specific operational prerequisites:

Architectural Scope and Dependencies

• Modular Decoupling: When deploying or removing the client manually on desktop environments, individual modules (such as DART, ISE Posture, or Umbrella) function as distinct software packages. When performing a piecemeal removal, auxiliary modules must be removed before or concurrently with the Core AnyConnect VPN package.
• Network Stack Interaction: Cisco Secure Client installs low-level drivers, including virtual miniport adapters on Windows and Network System Extensions (com.cisco.secureclient.*) on macOS. Uninstallation routines must unbind these network hooks cleanly to prevent routing drops or persistent DNS blackholes.
• Privilege Requirements: Elevated administrative privileges (Administrator elevation on Windows; root / sudo execution on macOS and Linux) are mandatory. Standard user sessions cannot invoke MSI uninstaller engines or remove kernel-level system extensions.
• Active Session Termination: Official documentation requires all active VPN tunnels and daemons (csc_vpnagent, vpnagent) to be disconnected and terminated prior to initiating uninstallation routines. Removing the client during an active tunnel can corrupt system routing tables.

Step-by-Step Guide: Uninstalling Cisco Secure Client on Windows 11 and 10

Windows users can remove Cisco Secure Client using either the native Windows Settings interface or the legacy Control Panel. The following steps ensure both auxiliary security modules and the core VPN adapter are removed completely.

Step 1: Disconnect and Close the Client

1. Click the System Tray (arrow near the bottom-right taskbar clock).
2. Right-click the Cisco Secure Client icon.
3. If an active connection is established, click Disconnect.
4. Click Quit or right-click and choose Exit to shut down the client interface.

Step 2: Open Installed Applications

You can use either modern Settings or the classic Control Panel:
* Via Windows Settings (Recommended on Windows 11):
Press Win + I to open Settings, navigate to Apps in the left sidebar, and select Installed apps (or Apps & features on Windows 10).
* Via Control Panel:
Press Win + R, type appwiz.cpl, and press Enter to open the Programs and Features window.

Step 3: Remove Auxiliary Modules First

In the search bar of the installed apps list, type Cisco. You will likely see multiple entries depending on your organization’s configuration (e.g., Cisco Secure Client – DART, Cisco Secure Client – Posture, Cisco Secure Client – Umbrella).

1. Locate any auxiliary modules listed.
2. Click the three dots next to the module (or right-click it in Control Panel) and select Uninstall.
3. Click Yes when prompted by User Account Control (UAC) to provide administrative approval.
4. Repeat this step for all secondary Cisco Secure Client packages.

Step 4: Remove the Core Client Package

1. Once auxiliary modules are cleared, locate Cisco Secure Client – AnyConnect VPN (or the primary Cisco Secure Client entry).
2. Select Uninstall and confirm the removal prompt.
3. Follow the on-screen uninstaller wizard until the progress bar completes.

Step 5: Clean Up Residual Data and Restart

While the uninstaller removes binary files and drivers, cached XML connection profiles and gateway certificates frequently remain behind.

1. Press Win + R, type %ProgramData%\Cisco, and press Enter.
2. If present, delete the Cisco Secure Client or Cisco AnyConnect Secure Mobility Client folder.
3. Press Win + R, type %LocalAppData%\Cisco, and press Enter; delete any matching Cisco folders.
4. Restart your computer to allow Windows to rebind default network adapters cleanly.

Step-by-Step Guide: Completely Removing Cisco Secure Client on macOS via Terminal

On macOS, dragging the Cisco Secure Client icon from the Applications folder to the Trash leaves system launch daemons, kernel extensions, and network filters active. To achieve a complete, vendor-approved uninstallation, use Cisco’s native uninstaller app or execute the included uninstallation shell script in Terminal.

Method A: Using the Native Finder Uninstaller (GUI)

1. Open Finder and navigate to your Applications folder.
2. Locate and open the Cisco folder.
3. Double-click the Uninstall Cisco Secure Client application.
4. Enter your macOS administrator credentials when prompted, follow the uninstallation wizard, and restart your Mac when finished.

Method B: Executing the Native Uninstall Script via Terminal (Recommended)

If the GUI uninstaller is missing or fails to run, Cisco provides administrative shell scripts directly within the installation root directory (/opt/cisco/secureclient/bin/).

1. Launch Terminal

Open Terminal by pressing Cmd + Space, typing Terminal, and pressing Enter (or locate it under /Applications/Utilities/Terminal.app).

2. Run the Comprehensive Uninstaller Script

To wipe the entire Cisco Secure Client suite in a single command, execute:

sudo /opt/cisco/secureclient/bin/cisco_secure_client_uninstall.sh

(Note: For legacy AnyConnect 4.x installations, run sudo /opt/cisco/anyconnect/bin/anyconnect_uninstall.sh instead).

Type your Mac administrator password when prompted (characters will not appear on the screen) and press Enter. The script will terminate all background daemons, unregister system extensions, and remove binaries.

3. Module-Specific Removal Commands

If your organization requires retaining the core VPN while stripping specific telemetry or web filtering components, execute the corresponding standalone script:

• Umbrella Roaming Security:
  bash
sudo /opt/cisco/secureclient/bin/umbrella_uninstall.sh
• DART Diagnostic Module:
  bash
sudo /opt/cisco/secureclient/bin/dart_uninstall.sh
• Cisco ISE Posture:
  bash
sudo /opt/cisco/secureclient/bin/iseposture_uninstall.sh
• Web Security:
  bash
sudo /opt/cisco/secureclient/bin/websecurity_uninstall.sh
• Core VPN Module Only:
  bash
sudo /opt/cisco/secureclient/bin/vpn_uninstall.sh

4. Purge Residual Receipts and Reboot

To verify that no lingering installation receipts or network extensions remain, run the following cleanup commands:

sudo pkgutil --forget com.cisco.pkg.anyconnect.vpn 2>/dev/null
sudo pkgutil --forget com.cisco.pkg.secureclient.vpn 2>/dev/null
sudo rm -rf /opt/cisco/secureclient /opt/cisco/anyconnect

Restart your Mac to refresh the macOS network subsystem and completely unload any active network filters.

Enterprise Automation: Silent Uninstallation via CLI and PowerShell

For systems administrators managing enterprise fleets with tools like Microsoft Intune, MECM (SCCM), or Datto RMM, manual GUI removal is impractical. The following automated commands and PowerShell templates perform unattended, silent removals across endpoints.

Command-Line Template: Standard MSIExec Silent Removal

Cisco Secure Client modules on Windows install as individual Windows Installer (MSI) packages. If you know the product code GUID for your specific build, run:

msiexec.exe /x {ENTER-PRODUCT-GUID-HERE} /qn /norestart /L*v "%TEMP%\csc_uninstall.log"

Automation Script: Complete PowerShell Silent Uninstaller

Because Cisco Secure Client product GUIDs change across point releases and modular builds, dynamically enumerating the Windows Registry uninstall hives ensures all related packages are caught in a single pass.

<#
.SYNOPSIS
    Silently uninstalls all modules of Cisco Secure Client / AnyConnect and purges residual directories.
.REQUIREMENTS
    Run from an elevated PowerShell session (Run as Administrator).
#>

[CmdletBinding()]
param()

$TargetKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

Write-Host "Searching registry for Cisco Secure Client modules..." -ForegroundColor Cyan

$InstalledCiscoPackages = Get-ItemProperty -Path $TargetKeys -ErrorAction SilentlyContinue | 
    Where-Object { 
        ($_.DisplayName -like "*Cisco Secure Client*" -or $_.DisplayName -like "*Cisco AnyConnect*") -and 
        $_.UninstallString -match "msiexec"
    }

if ($InstalledCiscoPackages) {
    foreach ($Package in $InstalledCiscoPackages) {
        $Guid = $Package.PSChildName
        Write-Host "Uninstalling: $($Package.DisplayName) ($Guid)..." -ForegroundColor Yellow

        $ProcessArgs = "/x `"$Guid`" /qn /norestart /L*v `"$env:WINDIR\Temp\Uninstall_$($Guid).log`""
        $Process = Start-Process -FilePath "msiexec.exe" -ArgumentList $ProcessArgs -Wait -PassThru

        if ($Process.ExitCode -eq 0 -or $Process.ExitCode -eq 3010) {
            Write-Host "Successfully removed $($Package.DisplayName)." -ForegroundColor Green
        } else {
            Write-Warning "Failed to uninstall $($Package.DisplayName). Exit Code: $($Process.ExitCode)"
        }
    }
} else {
    Write-Host "No Cisco Secure Client MSI packages detected." -ForegroundColor Gray
}

# Post-uninstallation filesystem cleanup
Write-Host "Cleaning residual filesystem directories..." -ForegroundColor Cyan
$ResidualDirectories = @(
    "$env:ProgramData\Cisco",
    "$env:ProgramFiles\Cisco\Cisco Secure Client",
    "$env:ProgramFiles(x86)\Cisco\Cisco Secure Client"
)

foreach ($Dir in $ResidualDirectories) {
    if (Test-Path -Path $Dir) {
        Remove-Item -Path $Dir -Recurse -Force -ErrorAction SilentlyContinue
        Write-Host "Removed residual directory: $Dir" -ForegroundColor Green
    }
}

Write-Host "Cisco Secure Client automated uninstallation routine complete." -ForegroundColor Cyan

Troubleshooting Common Removal Errors: Access Denied and Blocked Uninstallers

Frequently Asked Questions

Why is the “Uninstall” button grayed out or missing in Windows Settings?
This issue occurs on endpoints managed by an organization via Mobile Device Management (MDM) solutions (such as Microsoft Intune) or Active Directory Group Policy (GPO). System administrators frequently disable application modification for non-elevated user accounts.
* Resolution: Ensure you are logged into a local Windows account with full administrative rights. If the system is strictly bound to corporate domain policies, you cannot bypass this restriction locally; an administrator must assign an uninstallation deployment profile or temporarily move the machine to an unrestricted organizational unit (OU).

How do I fix “Error 1321” or “Access Denied” when trying to uninstall?
An “Access Denied” error during removal typically means the background service daemon—csc_vpnagent.exe on Windows or cisco-secure-client-vpn on macOS—is locking socket adapters, virtual interface drivers, or configuration files.
* Resolution on Windows:
1. Press Win + R, type services.msc, and press Enter.
2. Scroll down to find Cisco Secure Client – AnyConnect VPN Agent Service (or csc_vpnagent).
3. Right-click the service, select Stop, and re-attempt the uninstallation.
4. If the service refuses to stop, reboot Windows into Safe Mode and execute the uninstallation from the Control Panel.
* Resolution on macOS:
Open Terminal and unload the background service daemon manually prior to script execution:
bash
sudo launchctl unload /Library/LaunchDaemons/com.cisco.secureclient.vpnagentd.plist

What should I do if the uninstaller fails due to a missing MSI or corrupted installation package?
When updating or cleaning up applications, Windows relies on cached installation databases inside C:\Windows\Installer. If these .msi files become deleted or corrupted, Windows returns Error 1714 (“The older version of Cisco Secure Client cannot be removed”).
* Resolution:
1. Download the official Microsoft Program Install and Uninstall Troubleshooter tool from Microsoft’s support portal.
2. Launch the utility, choose Uninstalling, and select Cisco Secure Client from the detected registry list to force-strip corrupted deployment registrations.
3. Alternatively, obtain the exact version of the Cisco installer package (.msi) used to install the software, open an elevated command prompt, and run msiexec.exe /x "Path_To_Original_Installer.msi" /qn to supply the missing database logic directly.

Conclusion

Uninstalling Cisco Secure Client requires treating the software as a modular security framework rather than a single standalone application. While standard Windows Settings and the native macOS uninstallation script handle routine removals on individual machines, organizations managing multi-device environments benefit from dynamic PowerShell scripts that clear registry GUIDs and residual file trees automatically. If you encounter locked daemons or access restrictions, stopping active services or consulting with your IT department ensures your device’s network adapters return to their clean, default configurations.

Please follow and like us: