<\/span><\/h3>\nThe “Uninstall” button is disabled when AnyConnect was deployed using an enterprise MSI package that includes the ARPNOREMOVE=1<\/code> property, or when an administrative policy sets the NoRemove<\/code> DWORD value to 1<\/code> in the Windows Registry under HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{Product-GUID}<\/code>. Corporate endpoint management systems (such as Microsoft Intune, SCCM, or Group Policy) apply this flag to prevent end users from disconnecting from mandatory enterprise posture and compliance networks.<\/p>\n<\/span>Q: Why does the uninstaller report “Access Denied” even when run as a local administrator?<\/span><\/h3>\n“Access Denied” errors occur when the AnyConnect Agent service (vpnagent.exe<\/code>) or the Network Access Manager (NAM) driver maintains an active, exclusive lock on system network adapters and filtering services. Additionally, third-party Endpoint Detection and Response (EDR) agents or tamper-protection features may flag the sudden termination of AnyConnect services or modifications to its program folders as unauthorized activity, halting the uninstallation process.<\/p>\n<\/span>Q: What causes “Windows Installer Error 1721” during removal?<\/span><\/h3>\nWindows Installer Error 1721 (“There is a problem with this Windows Installer package. A program required for this install to complete could not be run”) occurs when the AnyConnect uninstaller invokes a custom action script or DLL that has already been deleted, corrupted, or blocked by the operating system. When the uninstaller cannot locate the specified helper binary to cleanly unbind the virtual adapter or stop the VPN service, the MSI engine aborts and rolls back all changes.<\/p>\n
\n<\/span>Cisco Official Uninstallation Documentation and Cleanup Resources<\/span><\/h2>\n<\/span>Definition and Architecture Overview<\/span><\/h3>\nCisco AnyConnect Secure Mobility Client and Cisco Secure Client employ a modular, component-based deployment model. The software comprises a core framework alongside several optional modules:
\n* Core VPN Client:<\/strong> Manages virtual adapter binding, encryption, and tunnel establishment.
\n* Network Access Manager (NAM):<\/strong> Controls Layer 2 network interfaces, wireless authentication, and 802.1X supplicant policies.
\n* Posture \/ ISE Agent:<\/strong> Validates host compliance and security baseline rules prior to network admission.
\n* Umbrella Roaming Security:<\/strong> Enforces DNS-layer security and IP-layer enforcement.
\n* Web Security & Telemetry:<\/strong> Monitors endpoint traffic and endpoint analytics.<\/p>\n<\/span>Component Removal Hierarchy<\/span><\/h3>\nOfficial Cisco documentation requires that bundled client packages be uninstalled in reverse order of dependency. Attempting to remove the Core VPN client while auxiliary modules remain installed results in installer errors. The mandatory removal sequence is:
\n1. Cisco AnyConnect Posture \/ ISE Compliance Module
\n2. Cisco AnyConnect Network Access Manager
\n3. Cisco AnyConnect Web Security Module \/ Cisco Secure Client Umbrella
\n4. Cisco AnyConnect Diagnostic and Reporting Tool (DART)
\n5. Cisco AnyConnect Core VPN Client<\/p>\n
<\/span>Accessing Official Cleanup Tools<\/span><\/h3>\n\n- Cisco Software Central:<\/strong> Standalone cleanup utilities, enterprise deployment scripts, and complete installer packages are hosted on Cisco Software Central. Downloading these files requires a valid Cisco Connection Online (CCO) account linked to an active Cisco Smart Net Total Care contract.<\/li>\n
- Diagnostic and Reporting Tool (DART):<\/strong> If a deployment cannot be removed cleanly, Cisco Technical Assistance Center (TAC) recommends gathering logs using DART before attempting destructive removal. DART collects installer logs located at
%TEMP%\\anyconnect-win-*-install.log<\/code> (Windows) or \/var\/log\/cisco\/<\/code> (macOS).<\/li>\n- TAC Community Cleanup Scripts:<\/strong> Cisco TAC engineers frequently publish validated PowerShell and Bash cleanup scripts on the Cisco Community Portal. These community scripts force-unregister AnyConnect Windows Installer GUIDs and unbind legacy Network Device Interface Specification (NDIS) drivers when standard MSI routines fail.<\/li>\n<\/ul>\n
\n<\/span>Step-by-Step Guide to Force Uninstalling AnyConnect on Windows 10 and 11<\/span><\/h2>\nWhen the standard Windows “Installed Apps” interface fails or triggers rollback loops, execute the following step-by-step sequence to force the removal.<\/p>\n
<\/span>Step 1: Terminate Locked AnyConnect Services and Processes<\/span><\/h3>\n\n- Press
Ctrl + Shift + Esc<\/code> to open Task Manager, and select the Details<\/strong> tab.<\/li>\n- Locate and terminate the following active processes by clicking End Process<\/strong>:<\/li>\n
vpnui.exe<\/code><\/li>\nvpnagent.exe<\/code><\/li>\naciscsp.exe<\/code><\/li>\nacsock.exe<\/code><\/li>\n- Press
Win + R<\/code>, type services.msc<\/code>, and press Enter<\/strong>.<\/li>\n- Right-click Cisco AnyConnect Secure Mobility Agent<\/strong>, click Properties<\/strong>, set the Startup type<\/strong> to Disabled<\/strong>, and click Stop<\/strong>.<\/li>\n<\/ol>\n
<\/span>Step 2: Remove Dependent Modules in Sequential Order<\/span><\/h3>\n\n- Press
Win + R<\/code>, type appwiz.cpl<\/code>, and press Enter<\/strong> to access the legacy Programs and Features control panel.<\/li>\n- Review the list of installed software for any Cisco modules.<\/li>\n
- Uninstall the modules sequentially according to Cisco’s required dependency chain (as covered above):<\/li>\n
- Posture<\/li>\n
- Network Access Manager<\/li>\n
- Umbrella<\/li>\n
- DART<\/li>\n
- Core VPN Client<\/li>\n
- If an individual module uninstalls successfully, restart the computer before moving to the next.<\/li>\n<\/ol>\n
<\/span>Step 3: Run the Microsoft Program Install and Uninstall Troubleshooter<\/span><\/h3>\nIf the MSI uninstaller halts due to damaged registry pointers or Error 1721, download the official Microsoft Program Install and Uninstall Troubleshooter<\/strong> (formerly Microsoft Fix It).
\n1. Launch the downloaded utility and select Uninstalling<\/strong>.
\n2. From the list of applications, locate and select the problematic Cisco AnyConnect component.
\n3. Select Yes, try uninstall<\/strong> to let the tool patch missing registry product codes and bypass the broken custom action scripts that trigger Error 1721.<\/p>\n<\/span>Step 4: Execute Direct MSI Uninstallation via Elevated Command Prompt<\/span><\/h3>\nIf GUI uninstallers remain unresponsive, trigger the Windows Installer database directly using the package GUID:
\n1. Press Win + S<\/code>, type cmd<\/code>, right-click Command Prompt<\/strong>, and select Run as administrator<\/strong>.
\n2. Query the exact product code for the AnyConnect installation by running:
\n cmd
\n wmic product where \"name like 'Cisco AnyConnect%'\" get IdentifyingNumber, Name<\/code>
\n3. Use the returned GUID (enclosed in curly brackets) to execute a forced silent removal:
\n cmd
\n msiexec \/x {INSERT-YOUR-GUID-HERE} \/qn \/norestart<\/code><\/p>\n<\/span>Step 5: Perform Removal in Windows Safe Mode<\/span><\/h3>\nIf background drivers continue to prevent removal, boot Windows into Safe Mode:
\n1. Hold Shift<\/code> while clicking Restart<\/strong> from the Windows Start menu.
\n2. Navigate to Troubleshoot > Advanced options > Startup Settings > Restart<\/strong>.
\n3. Upon reboot, press 4<\/code> or F4<\/code> to enter Safe Mode<\/strong>.
\n4. In Safe Mode, run the uninstallation commands or launch third-party cleanup utilities without locked virtual network drivers interfering.<\/p>\n
\n<\/span>Step-by-Step Guide to Completely Removing AnyConnect on macOS via Terminal<\/span><\/h2>\nOn macOS, dragging Cisco AnyConnect from the Applications folder to the Trash does not remove system extensions, kernel extensions, or launch daemons. To clean the system entirely, use Cisco’s built-in uninstall shell scripts.<\/p>\n
<\/span>Step 1: Quit Active AnyConnect Applications<\/span><\/h3>\n\n- Click the AnyConnect icon in the top menu bar and select Quit<\/strong>.<\/li>\n
- Open Terminal<\/strong> from
\/Applications\/Utilities\/<\/code>.<\/li>\n- Check for and kill any lingering processes:
\n bash
\n sudo killall \"Cisco AnyConnect Secure Mobility Client\" 2>\/dev\/null
\n sudo killall vpnagentd 2>\/dev\/null<\/code><\/li>\n<\/ol>\n<\/span>Step 2: Execute the Native Cisco Removal Script<\/span><\/h3>\nCisco provides native shell scripts designed to deregister system extensions, delete configuration plists, and clear binaries. The exact path depends on whether you are running legacy AnyConnect or the newer Cisco Secure Client.<\/p>\n
For Cisco AnyConnect 4.x and earlier<\/strong>, run:<\/p>\nsudo \/opt\/cisco\/anyconnect\/bin\/anyconnect_uninstall.sh\n<\/code><\/pre>\nFor Cisco Secure Client 5.x and newer<\/strong>, run:<\/p>\nsudo \/opt\/cisco\/secureclient\/bin\/cisco_secure_client_uninstall.sh\n<\/code><\/pre>\nIf auxiliary modules were installed, trigger their respective uninstall scripts located in the same directory:<\/p>\n
sudo \/opt\/cisco\/anyconnect\/bin\/dart_uninstall.sh\nsudo \/opt\/cisco\/anyconnect\/bin\/posture_uninstall.sh\n<\/code><\/pre>\n<\/span>Step 3: Remove Residual System Extensions and Preference Panes<\/span><\/h3>\nIf macOS blocked the uninstaller from disabling system extensions, review and clean remaining profiles:
\n1. Verify if any system extensions remain:
\n bash
\n systemextensionsctl list<\/code>
\n2. If a Cisco system extension appears, note the Team ID (DE8GLMVPEU<\/code>) and bundle identifier, then remove it through macOS system settings:
\n * Go to System Settings > General > Login Items & Extensions<\/strong>.
\n * Under Network Extensions<\/strong>, toggle off and remove any Cisco components.
\n3. Remove system-level preferences and certificates:
\n bash
\n sudo rm -rf \/Library\/Application\\ Support\/Cisco\/AnyConnect\\ Secure\\ Mobility\\ Client
\n sudo rm -rf \/Library\/Frameworks\/Cisco*
\n sudo rm -rf \/opt\/cisco<\/code><\/p>\n<\/span>Step 4: Purge User-Level Cache and Application Files<\/span><\/h3>\nRun the following commands to delete cached preferences and logs from your user profile:<\/p>\n
rm -rf ~\/Library\/Application\\ Support\/Cisco\nrm -rf ~\/Library\/Caches\/com.cisco.anyconnect.*\nrm -rf ~\/Library\/Preferences\/com.cisco.anyconnect.*\n<\/code><\/pre>\nRestart your Mac to finalize the unbinding of any network filter extensions.<\/p>\n
\n<\/span>Manual Residual Cleanup: PowerShell Script and File System Paths<\/span><\/h2>\nWhen installer databases become corrupted, the operating system can lose track of installed files, leaving behind orphan virtual network adapters and locked directories. The following PowerShell script terminates lingering services, removes remnant file directories, clears the system registry, and unbinds the virtual network adapter driver.<\/p>\n
# ==============================================================================\n# Script: CiscoAnyConnect-ResidualCleanup.ps1\n# Description: Force-terminates AnyConnect services, cleans system directories,\n# removes registry keys, and unbinds virtual adapter drivers.\n# Execution: Run from an elevated (Administrator) PowerShell session.\n# ==============================================================================\n\nWrite-Host "Starting Cisco AnyConnect Residual Cleanup..." -ForegroundColor Cyan\n\n# 1. Stop and disable active AnyConnect services\n$services = @("vpnagent", "ciscodart", "aciscsp", "csc_vpnagent")\nforeach ($svc in $services) {\n if (Get-Service -Name $svc -ErrorAction SilentlyContinue) {\n Write-Host "Stopping service: $svc" -ForegroundColor Yellow\n Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue\n Set-Service -Name $svc -StartupType Disabled -ErrorAction SilentlyContinue\n }\n}\n\n# 2. Terminate running processes\n$processes = @("vpnui", "vpnagent", "aciscsp", "acsock")\nforeach ($proc in $processes) {\n Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force\n}\n\n# 3. Remove filesystem remnants\n$paths = @(\n "${env:ProgramFiles(x86)}\\Cisco\\Cisco AnyConnect Secure Mobility Client",\n "${env:ProgramFiles(x86)}\\Cisco\\Cisco Secure Client",\n "${env:ProgramData}\\Cisco\\Cisco AnyConnect Secure Mobility Client",\n "${env:ProgramData}\\Cisco\\Cisco Secure Client",\n "${env:LOCALAPPDATA}\\Cisco\\Cisco AnyConnect Secure Mobility Client",\n "${env:APPDATA}\\Cisco\\Cisco AnyConnect Secure Mobility Client"\n)\n\nforeach ($path in $paths) {\n if (Test-Path -Path $path) {\n Write-Host "Removing directory: $path" -ForegroundColor Yellow\n Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue\n }\n}\n\n# 4. Remove residual Windows Registry hives\n$regKeys = @(\n "HKLM:\\SOFTWARE\\Cisco\\Cisco AnyConnect Secure Mobility Client",\n "HKLM:\\SOFTWARE\\WOW6432Node\\Cisco\\Cisco AnyConnect Secure Mobility Client",\n "HKLM:\\SOFTWARE\\Cisco\\Cisco Secure Client",\n "HKLM:\\SOFTWARE\\WOW6432Node\\Cisco\\Cisco Secure Client",\n "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\vpnagent",\n "HKCU:\\Software\\Cisco\\Cisco AnyConnect Secure Mobility Client"\n)\n\nforeach ($key in $regKeys) {\n if (Test-Path -Path $key) {\n Write-Host "Deleting registry key: $key" -ForegroundColor Yellow\n Remove-Item -Path $key -Recurse -Force -ErrorAction SilentlyContinue\n }\n}\n\n# 5. Clean up Virtual Network Adapter remnants via netcfg\nWrite-Host "Checking for virtual network adapter remnants..." -ForegroundColor Cyan\n& netcfg.exe -u cisco_vpa 2>$null\n\nWrite-Host "Cleanup completed successfully. Please reboot your system." -ForegroundColor Green\n<\/code><\/pre>\nTo run this script:
\n1. Press Win + X<\/code> and select Terminal (Admin)<\/strong> or Windows PowerShell (Admin)<\/strong>.
\n2. Paste the script contents into the console and press Enter<\/strong>.
\n3. Restart the operating system to release any residual handles in the network driver subsystem.<\/p>\n
\n<\/span>Evaluating Third-Party Force Uninstallers for Stubborn AnyConnect Installations<\/span><\/h2>\nWhen manual registry editing is not preferred and native Windows uninstaller scripts continue to fail, specialized uninstaller software can force-remove locked program files, drivers, and background services. The table below compares the leading tools for removing corrupted AnyConnect installations:<\/p>\n
\n\n\n| Tool Name<\/th>\n | License Model<\/th>\n | Deep Registry \/ Force Scan<\/th>\n | Driver & Virtual Adapter Removal<\/th>\n | Best For<\/th>\n<\/tr>\n<\/thead>\n |
\n\nRevo Uninstaller Pro<\/strong><\/td>\n| Commercial (Free trial available)<\/td>\n | Advanced (Heuristic post-uninstall scanner)<\/td>\n | High (Identifies and purges kernel-mode drivers and service entries)<\/td>\n | Complete removal when uninstallation fails with Error 1721 or missing MSI files.<\/td>\n<\/tr>\n | \nBulk Crap Uninstaller (BCUninstaller)<\/strong><\/td>\n| Open-Source (Free)<\/td>\n | Advanced (Detects orphaned files and broken registry references)<\/td>\n | Moderate (Removes services; manual confirmation needed for network adapters)<\/td>\n | IT professionals needing automated, scriptable bulk removal of multiple Cisco modules.<\/td>\n<\/tr>\n | \nGeek Uninstaller<\/strong><\/td>\n| Freeware (Standard) \/ Commercial<\/td>\n | Moderate (Fast standard registry and folder scanner)<\/td>\n | Low (Removes file locks and main services; limited driver scrubbing)<\/td>\n | Quick, lightweight, portable cleanup on machines without administrative agent blocks.<\/td>\n<\/tr>\n | \nIObit Uninstaller<\/strong><\/td>\n| Commercial (Freemium version available)<\/td>\n | Advanced (Monitors active processes and registry branches)<\/td>\n | Moderate (Removes stubborn background tasks and residual services)<\/td>\n | Home users looking for a one-click automated solution with automatic restore points.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/span>Tool Recommendations<\/span><\/h3>\n\n- Revo Uninstaller Pro<\/strong> is the most reliable option for resolving failed AnyConnect installations. Its “Forced Uninstall” mode takes the application name or executable directory path, compares it against an internal database of installer behaviors, and removes all linked services, network hooks, and registry components without relying on the original MSI installer.<\/li>\n
- Bulk Crap Uninstaller (BCUninstaller)<\/strong> is ideal for system administrators handling corporate endpoints that need multiple AnyConnect sub-modules removed in batch. It ignores
NoRemove<\/code> flags and silent-uninstall restrictions out of the box.<\/li>\n<\/ul>\n
\n<\/span>Conclusion<\/span><\/h2>\nResolving uninstallation problems with Cisco AnyConnect requires addressing its core components in the right sequence: managing group policies, stopping locked system services, removing modules in the proper order, and cleaning out residual virtual adapter drivers. For macOS environments, using the native \/opt\/cisco\/<\/code> shell scripts ensures complete removal of hidden system extensions that dragging the app to the Trash misses. On Windows, executing command-line MSI removals or running automated PowerShell cleanups clears the registry entries and file locks that cause Error 1721. Following these structured troubleshooting steps restores your operating system to a clean state, ready for an updated client deployment or alternative network software.<\/p>\n | | | | |