Can’t Uninstall Cisco AnyConnect

Attempting to remove Cisco AnyConnect Secure Mobility Client (or its modern successor, Cisco Secure Client) frequently leads to unexpected roadblocks. Users often find themselves facing greyed-out “Uninstall” buttons, permission errors, sudden rollbacks, or installer errors such as Error 1721. Because AnyConnect integrates deeply into operating system network stacks, installs multiple dependent sub-modules, and binds virtual network adapters to system drivers, a broken or managed installation resists standard operating system removal methods.

Whether your uninstallation is blocked by enterprise administrative restrictions, corrupted installation databases, or orphaned virtual adapter drivers, this guide provides the necessary technical procedures, command-line scripts, and official utilities to completely purge Cisco AnyConnect from Windows and macOS systems.

Why Cisco AnyConnect Fails to Uninstall or Shows Greyed-Out Options

Q: Why is the “Uninstall” button greyed out in Windows Settings or Control Panel?

The “Uninstall” button is disabled when AnyConnect was deployed using an enterprise MSI package that includes the ARPNOREMOVE=1 property, or when an administrative policy sets the NoRemove DWORD value to 1 in the Windows Registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{Product-GUID}. Corporate endpoint management systems (such as Microsoft Intune, SCCM, or Group Policy) apply this flag to prevent end users from disconnecting from mandatory enterprise posture and compliance networks.

Q: Why does the uninstaller report “Access Denied” even when run as a local administrator?

“Access Denied” errors occur when the AnyConnect Agent service (vpnagent.exe) or the Network Access Manager (NAM) driver maintains an active, exclusive lock on system network adapters and filtering services. Additionally, third-party Endpoint Detection and Response (EDR) agents or tamper-protection features may flag the sudden termination of AnyConnect services or modifications to its program folders as unauthorized activity, halting the uninstallation process.

Q: What causes “Windows Installer Error 1721” during removal?

Windows Installer Error 1721 (“There is a problem with this Windows Installer package. A program required for this install to complete could not be run”) occurs when the AnyConnect uninstaller invokes a custom action script or DLL that has already been deleted, corrupted, or blocked by the operating system. When the uninstaller cannot locate the specified helper binary to cleanly unbind the virtual adapter or stop the VPN service, the MSI engine aborts and rolls back all changes.

Cisco Official Uninstallation Documentation and Cleanup Resources

Definition and Architecture Overview

Cisco AnyConnect Secure Mobility Client and Cisco Secure Client employ a modular, component-based deployment model. The software comprises a core framework alongside several optional modules:
* Core VPN Client: Manages virtual adapter binding, encryption, and tunnel establishment.
* Network Access Manager (NAM): Controls Layer 2 network interfaces, wireless authentication, and 802.1X supplicant policies.
* Posture / ISE Agent: Validates host compliance and security baseline rules prior to network admission.
* Umbrella Roaming Security: Enforces DNS-layer security and IP-layer enforcement.
* Web Security & Telemetry: Monitors endpoint traffic and endpoint analytics.

Component Removal Hierarchy

Official Cisco documentation requires that bundled client packages be uninstalled in reverse order of dependency. Attempting to remove the Core VPN client while auxiliary modules remain installed results in installer errors. The mandatory removal sequence is:
1. Cisco AnyConnect Posture / ISE Compliance Module
2. Cisco AnyConnect Network Access Manager
3. Cisco AnyConnect Web Security Module / Cisco Secure Client Umbrella
4. Cisco AnyConnect Diagnostic and Reporting Tool (DART)
5. Cisco AnyConnect Core VPN Client

Accessing Official Cleanup Tools

• Cisco Software Central: Standalone cleanup utilities, enterprise deployment scripts, and complete installer packages are hosted on Cisco Software Central. Downloading these files requires a valid Cisco Connection Online (CCO) account linked to an active Cisco Smart Net Total Care contract.
• Diagnostic and Reporting Tool (DART): If a deployment cannot be removed cleanly, Cisco Technical Assistance Center (TAC) recommends gathering logs using DART before attempting destructive removal. DART collects installer logs located at %TEMP%\anyconnect-win-*-install.log (Windows) or /var/log/cisco/ (macOS).
• TAC Community Cleanup Scripts: Cisco TAC engineers frequently publish validated PowerShell and Bash cleanup scripts on the Cisco Community Portal. These community scripts force-unregister AnyConnect Windows Installer GUIDs and unbind legacy Network Device Interface Specification (NDIS) drivers when standard MSI routines fail.

Step-by-Step Guide to Force Uninstalling AnyConnect on Windows 10 and 11

When the standard Windows “Installed Apps” interface fails or triggers rollback loops, execute the following step-by-step sequence to force the removal.

Step 1: Terminate Locked AnyConnect Services and Processes

1. Press Ctrl + Shift + Esc to open Task Manager, and select the Details tab.
2. Locate and terminate the following active processes by clicking End Process:
3. vpnui.exe
4. vpnagent.exe
5. aciscsp.exe
6. acsock.exe
7. Press Win + R, type services.msc, and press Enter.
8. Right-click Cisco AnyConnect Secure Mobility Agent, click Properties, set the Startup type to Disabled, and click Stop.

Step 2: Remove Dependent Modules in Sequential Order

1. Press Win + R, type appwiz.cpl, and press Enter to access the legacy Programs and Features control panel.
2. Review the list of installed software for any Cisco modules.
3. Uninstall the modules sequentially according to Cisco’s required dependency chain (as covered above):
4. Posture
5. Network Access Manager
6. Umbrella
7. DART
8. Core VPN Client
9. If an individual module uninstalls successfully, restart the computer before moving to the next.

Step 3: Run the Microsoft Program Install and Uninstall Troubleshooter

If the MSI uninstaller halts due to damaged registry pointers or Error 1721, download the official Microsoft Program Install and Uninstall Troubleshooter (formerly Microsoft Fix It).
1. Launch the downloaded utility and select Uninstalling.
2. From the list of applications, locate and select the problematic Cisco AnyConnect component.
3. Select Yes, try uninstall to let the tool patch missing registry product codes and bypass the broken custom action scripts that trigger Error 1721.

Step 4: Execute Direct MSI Uninstallation via Elevated Command Prompt

If GUI uninstallers remain unresponsive, trigger the Windows Installer database directly using the package GUID:
1. Press Win + S, type cmd, right-click Command Prompt, and select Run as administrator.
2. Query the exact product code for the AnyConnect installation by running:
cmd
wmic product where "name like 'Cisco AnyConnect%'" get IdentifyingNumber, Name
3. Use the returned GUID (enclosed in curly brackets) to execute a forced silent removal:
cmd
msiexec /x {INSERT-YOUR-GUID-HERE} /qn /norestart

Step 5: Perform Removal in Windows Safe Mode

If background drivers continue to prevent removal, boot Windows into Safe Mode:
1. Hold Shift while clicking Restart from the Windows Start menu.
2. Navigate to Troubleshoot > Advanced options > Startup Settings > Restart.
3. Upon reboot, press 4 or F4 to enter Safe Mode.
4. In Safe Mode, run the uninstallation commands or launch third-party cleanup utilities without locked virtual network drivers interfering.

Step-by-Step Guide to Completely Removing AnyConnect on macOS via Terminal

On macOS, dragging Cisco AnyConnect from the Applications folder to the Trash does not remove system extensions, kernel extensions, or launch daemons. To clean the system entirely, use Cisco’s built-in uninstall shell scripts.

Step 1: Quit Active AnyConnect Applications

1. Click the AnyConnect icon in the top menu bar and select Quit.
2. Open Terminal from /Applications/Utilities/.
3. Check for and kill any lingering processes:
   bash
sudo killall "Cisco AnyConnect Secure Mobility Client" 2>/dev/null
sudo killall vpnagentd 2>/dev/null

Step 2: Execute the Native Cisco Removal Script

Cisco provides native shell scripts designed to deregister system extensions, delete configuration plists, and clear binaries. The exact path depends on whether you are running legacy AnyConnect or the newer Cisco Secure Client.

For Cisco AnyConnect 4.x and earlier, run:

sudo /opt/cisco/anyconnect/bin/anyconnect_uninstall.sh

For Cisco Secure Client 5.x and newer, run:

sudo /opt/cisco/secureclient/bin/cisco_secure_client_uninstall.sh

If auxiliary modules were installed, trigger their respective uninstall scripts located in the same directory:

sudo /opt/cisco/anyconnect/bin/dart_uninstall.sh
sudo /opt/cisco/anyconnect/bin/posture_uninstall.sh

Step 3: Remove Residual System Extensions and Preference Panes

If macOS blocked the uninstaller from disabling system extensions, review and clean remaining profiles:
1. Verify if any system extensions remain:
bash
systemextensionsctl list
2. If a Cisco system extension appears, note the Team ID (DE8GLMVPEU) and bundle identifier, then remove it through macOS system settings:
* Go to System Settings > General > Login Items & Extensions.
* Under Network Extensions, toggle off and remove any Cisco components.
3. Remove system-level preferences and certificates:
bash
sudo rm -rf /Library/Application\ Support/Cisco/AnyConnect\ Secure\ Mobility\ Client
sudo rm -rf /Library/Frameworks/Cisco*
sudo rm -rf /opt/cisco

Step 4: Purge User-Level Cache and Application Files

Run the following commands to delete cached preferences and logs from your user profile:

rm -rf ~/Library/Application\ Support/Cisco
rm -rf ~/Library/Caches/com.cisco.anyconnect.*
rm -rf ~/Library/Preferences/com.cisco.anyconnect.*

Restart your Mac to finalize the unbinding of any network filter extensions.

Manual Residual Cleanup: PowerShell Script and File System Paths

When installer databases become corrupted, the operating system can lose track of installed files, leaving behind orphan virtual network adapters and locked directories. The following PowerShell script terminates lingering services, removes remnant file directories, clears the system registry, and unbinds the virtual network adapter driver.

# ==============================================================================
# Script: CiscoAnyConnect-ResidualCleanup.ps1
# Description: Force-terminates AnyConnect services, cleans system directories,
#              removes registry keys, and unbinds virtual adapter drivers.
# Execution: Run from an elevated (Administrator) PowerShell session.
# ==============================================================================

Write-Host "Starting Cisco AnyConnect Residual Cleanup..." -ForegroundColor Cyan

# 1. Stop and disable active AnyConnect services
$services = @("vpnagent", "ciscodart", "aciscsp", "csc_vpnagent")
foreach ($svc in $services) {
    if (Get-Service -Name $svc -ErrorAction SilentlyContinue) {
        Write-Host "Stopping service: $svc" -ForegroundColor Yellow
        Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
        Set-Service -Name $svc -StartupType Disabled -ErrorAction SilentlyContinue
    }
}

# 2. Terminate running processes
$processes = @("vpnui", "vpnagent", "aciscsp", "acsock")
foreach ($proc in $processes) {
    Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force
}

# 3. Remove filesystem remnants
$paths = @(
    "${env:ProgramFiles(x86)}\Cisco\Cisco AnyConnect Secure Mobility Client",
    "${env:ProgramFiles(x86)}\Cisco\Cisco Secure Client",
    "${env:ProgramData}\Cisco\Cisco AnyConnect Secure Mobility Client",
    "${env:ProgramData}\Cisco\Cisco Secure Client",
    "${env:LOCALAPPDATA}\Cisco\Cisco AnyConnect Secure Mobility Client",
    "${env:APPDATA}\Cisco\Cisco AnyConnect Secure Mobility Client"
)

foreach ($path in $paths) {
    if (Test-Path -Path $path) {
        Write-Host "Removing directory: $path" -ForegroundColor Yellow
        Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue
    }
}

# 4. Remove residual Windows Registry hives
$regKeys = @(
    "HKLM:\SOFTWARE\Cisco\Cisco AnyConnect Secure Mobility Client",
    "HKLM:\SOFTWARE\WOW6432Node\Cisco\Cisco AnyConnect Secure Mobility Client",
    "HKLM:\SOFTWARE\Cisco\Cisco Secure Client",
    "HKLM:\SOFTWARE\WOW6432Node\Cisco\Cisco Secure Client",
    "HKLM:\SYSTEM\CurrentControlSet\Services\vpnagent",
    "HKCU:\Software\Cisco\Cisco AnyConnect Secure Mobility Client"
)

foreach ($key in $regKeys) {
    if (Test-Path -Path $key) {
        Write-Host "Deleting registry key: $key" -ForegroundColor Yellow
        Remove-Item -Path $key -Recurse -Force -ErrorAction SilentlyContinue
    }
}

# 5. Clean up Virtual Network Adapter remnants via netcfg
Write-Host "Checking for virtual network adapter remnants..." -ForegroundColor Cyan
& netcfg.exe -u cisco_vpa 2>$null

Write-Host "Cleanup completed successfully. Please reboot your system." -ForegroundColor Green

To run this script:
1. Press Win + X and select Terminal (Admin) or Windows PowerShell (Admin).
2. Paste the script contents into the console and press Enter.
3. Restart the operating system to release any residual handles in the network driver subsystem.

Evaluating Third-Party Force Uninstallers for Stubborn AnyConnect Installations

When manual registry editing is not preferred and native Windows uninstaller scripts continue to fail, specialized uninstaller software can force-remove locked program files, drivers, and background services. The table below compares the leading tools for removing corrupted AnyConnect installations:

Tool Recommendations

• Revo Uninstaller Pro is the most reliable option for resolving failed AnyConnect installations. Its “Forced Uninstall” mode takes the application name or executable directory path, compares it against an internal database of installer behaviors, and removes all linked services, network hooks, and registry components without relying on the original MSI installer.
• Bulk Crap Uninstaller (BCUninstaller) is ideal for system administrators handling corporate endpoints that need multiple AnyConnect sub-modules removed in batch. It ignores NoRemove flags and silent-uninstall restrictions out of the box.

Conclusion

Resolving uninstallation problems with Cisco AnyConnect requires addressing its core components in the right sequence: managing group policies, stopping locked system services, removing modules in the proper order, and cleaning out residual virtual adapter drivers. For macOS environments, using the native /opt/cisco/ shell scripts ensures complete removal of hidden system extensions that dragging the app to the Trash misses. On Windows, executing command-line MSI removals or running automated PowerShell cleanups clears the registry entries and file locks that cause Error 1721. Following these structured troubleshooting steps restores your operating system to a clean state, ready for an updated client deployment or alternative network software.

Please follow and like us: