Delete Zoom with a Munki NoPkg

Zoom Video Communications has been in the news again lately, and not in a good way. Shortly after Google and the U.S. Senate made the decision to ban Zoom from all their devices my company followed suit.

We didn’t have Zoom installed on a large percentage of our computers, but I still needed a way to remove it now and in the future. Utilizing information shared by other MacAdmins, and the official documentation, I compiled a list of all files Zoom installs across macOS and wrote a script to search and destroy.

If the details could be helpful for you please read on.

We are a Munki shop so I set out to automatically scan for and remove Zoom files every hour with a NoPkg. You’ll see the only thing I leave behind is zoominstall.log so I have a record of installations.

Last week Jonas Bygdén shared a similar NoPkg in the #munki channel on the MacAdmins Slack, but it only removed Zoom from the Applications folder. Since our users are not admins I needed to ensure that we searched out all files even in user home directories.

Helpful as always, Alan Sui also shared an example one line script that could be used to help get the job done. The combination of all of the above research and examples resulted in the following NoPkg which I deployed today.

If you don’t use Munki you can pull the postinstall_script from the NoPkg and use it with Apple Remote Desktop or another management solution.

If you know of any files or folders I missed please let me know or feel free to submit a pull request on Github!

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>_metadata</key>
	<dict>
		<key>created_by</key>
		<string>kevinmcox</string>
		<key>creation_date</key>
		<date>2020-04-11T00:44:44Z</date>
		<key>munki_version</key>
		<string>4.1.2.3939</string>
		<key>os_version</key>
		<string>10.14.6</string>
	</dict>
	<key>autoremove</key>
	<false/>
	<key>catalogs</key>
	<array>
		<string>testing</string>
	</array>
	<key>category</key>
	<string>NoPkg</string>
	<key>description</key>
	<string>Zoom.us will be removed from your computer as it’s use is prohibited by corporate policy.</string>
	<key>developer</key>
	<string>Kevin M. Cox</string>
	<key>display_name</key>
	<string>Zoom Search &amp; Destory</string>
	<key>icon_name</key>
	<string>ZoomSearchDestroy.png</string>
	<key>installcheck_script</key>
	<string>#!/bin/bash

# Zoom Search and Destroy
# Version 1.2
# By Kevin M. Cox
# Last updated 4/10/20

# Begin Search Phase
echo "Searching for Zoom files..."

if
	# System Locations
	[ -d /Applications/zoom.us.app ] ||
	[ -d /Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver ] ||
	[ -d /Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin ] ||
	[ -d /System/Library/Extensions/ZoomAudioDevice.kext ] ||
	# User Directory Locations
	[ -d /Users/*/.zoomus/ ] ||
	[ -d /Users/*/Applications/zoom.us.app ] ||
	[ -d /Users/*/Library/Application\ Support/zoom.us/ ] ||
	[ -d /Users/*/Library/Caches/us.zoom.xos ] ||
	[ -d /Users/*/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin ] ||
	[ -d /Users/*/Library/Logs/zoom.us/ ] ||
	[ -f /Users/*/Library/Preferences/us.zoom.xos.plist ] ||
	[ -f /Users/*/Library/Preferences/ZoomChat.plist ]
then
	echo "Zoom files found! Proceeding to removal process..."
	exit 0
fi

if
	# User Installation Log
	[ -f /Users/*/Library/Logs/zoominstall.log ]
then
	echo "Zoom installer log found, but no current installation detected. No removal needed."
	exit 1
fi

echo "No traces of Zoom found."

exit 1</string>
	<key>installer_type</key>
	<string>nopkg</string>
	<key>minimum_os_version</key>
	<string>10.4.0</string>
	<key>name</key>
	<string>ZoomSearchDestroy</string>
	<key>postinstall_script</key>
	<string>#!/bin/bash

# Zoom Search and Destroy
# Version 1.2
# By Kevin M. Cox
# Last updated 4/10/20

# Begin Destroy Phase
echo "Search and Destroy Zoom files..."

# System Locations

if
	[ -d /Applications/zoom.us.app ]
then
	/bin/rm -rf /Applications/zoom.us.app
	echo "Deleted /Applications/zoom.us.app"
fi

if
	[ -d /Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver ]
then
	/bin/rm -rf /Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver
	echo "Deleted /Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver"
fi

if
	[ -d /Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin ]
then
	/bin/rm -rf /Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin
	echo "Deleted /Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin"
fi

if
	[ -d /System/Library/Extensions/ZoomAudioDevice.kext ]
then
	kextunload -b zoom.us.ZoomAudioDevice
	/bin/rm -rf /System/Library/Extensions/ZoomAudioDevice.kext
	echo "Deleted /System/Library/Extensions/ZoomAudioDevice.kext"
fi

# User Directory Locations

if
	[ -d /Users/*/.zoomus/ ]
then
	/bin/rm -rf /Users/*/.zoomus/
	echo "Deleted /Users/*/.zoomus/"
fi

if
	[ -d /Users/*/Applications/zoom.us.app ]
then
	/bin/rm -rf /Users/*/Applications/zoom.us.app
	echo "Deleted /Users/*/Applications/zoom.us.app"
fi

if
	[ -d /Users/*/Library/Application\ Support/zoom.us/ ]
then
	/bin/rm -rf /Users/*/Library/Application\ Support/zoom.us/
	echo "Deleted /Users/*/Library/Application\ Support/zoom.us/"
fi

if
	[ -d /Users/*/Library/Caches/us.zoom.xos ]
then
	/bin/rm -rf /Users/*/Library/Caches/us.zoom.xos
	echo "Deleted /Users/*/Library/Caches/us.zoom.xos"
fi

if
	[ -d /Users/*/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin ]
then
	/bin/rm -rf /Users/*/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin
	echo "Deleted /Users/*/Library/Internet\ Plug-Ins/ZoomUsPlugIn.plugin"
fi

if
	[ -d /Users/*/Library/Logs/zoom.us/ ]
then
	/bin/rm -rf /Users/*/Library/Logs/zoom.us/
	echo "Deleted /Users/*/Library/Logs/zoom.us/"
fi

if
	[ -f /Users/*/Library/Preferences/us.zoom.xos.plist ]
then
	/bin/rm -f /Users/*/Library/Preferences/us.zoom.xos.plist
	echo "Deleted /Users/*/Library/Preferences/us.zoom.xos.plist"
fi

if
	[ -f /Users/*/Library/Preferences/ZoomChat.plist ]
then
	/bin/rm -f /Users/*/Library/Preferences/ZoomChat.plist
	echo "Deleted /Users/*/Library/Preferences/ZoomChat.plist"
fi

echo "Zoom Search and Destroy complete."</string>
	<key>unattended_install</key>
	<true/>
	<key>version</key>
	<string>1.2</string>
</dict>
</plist>