Remove AI Watch

Use this page when decommissioning AI Watch from a fleet, rolling back a test deployment, or cleaning up legacy script-based installs. If you are only migrating from the old script-based macOS Detect rollout to the package, use Legacy macOS Detect Cleanup.

Removal order

Set Mode to Monitor and Sessions off from the deployment’s Manage settings dialog while AI Watch is still installed. Also set the MDM-owned legacy Enforcement=false and AutoUpdate=false fallback values.
Let AI Watch reconcile to Detect-only mode so it removes Runlayer hook entries and preserves third-party hooks.
Verify hook configs are absent.
Remove the package, profiles, and local agent artifacts (the MSI uninstall removes the Windows Scheduled Tasks).
Restart AI clients so they stop reading any cached hook configuration.

Do not remove the package first if Protect, Enforce, or Sessions installed hooks. The packaged aiwatch binary is what removes Runlayer hook entries safely after Mode is Monitor and Sessions is disabled.

pkgutil --forget is not an uninstaller. It only forgets the macOS installer receipt after files have been removed.

macOS

Phase 1 - Disable hooks

In Settings → MDM configuration → Manage settings, set Mode to Monitor and Sessions off. Then re-push the AI Watch tenant configuration profile with automatic updates disabled and the same Monitor / Sessions fallback values for older or offline clients:

<key>Mode</key>
<string>monitor</string>
<key>Enforcement</key>
<false/>
<key>Sessions</key>
<false/>
<key>AutoUpdate</key>
<false/>

Keep the AI Watch .pkg and tenant configuration profile assigned until hook reconciliation finishes. AutoUpdate=false prevents the hourly updater from racing package removal. The bootstrap LaunchDaemon then runs aiwatch setup hooks install --mdm on its normal schedule and removes Runlayer hook entries. To force reconciliation immediately, push this one-time script as root:

#!/bin/bash
set -euo pipefail

/usr/local/bin/aiwatch setup hooks install --mdm
/usr/local/bin/aiwatch setup hooks check --mdm

check should exit 0 once the device is compliant with Detect-only hook state. When only Detect is enabled, stale Runlayer hooks are treated as drift so your MDM can remediate them.

Phase 2 - Remove the package

After hook reconciliation passes, unscope the device from the AI Watch .pkg assignment so the package cannot be reinstalled. Keep the tenant configuration profile with AutoUpdate=false assigned until local cleanup finishes; then unscope all three profiles:

Tenant configuration profile: com.runlayer.aiwatch
PPPC / Full Disk Access profile: com.runlayer.aiwatch.pppc
Login Items profile: com.runlayer.aiwatch.loginitems

While the tenant profile is still assigned, push this one-time package cleanup script as root:

#!/bin/bash
set -euo pipefail

CONSOLE_UID=$(stat -f %u /dev/console 2>/dev/null || echo "")

# Unload bundled LaunchAgents from the console user's GUI domain.
if [ -n "$CONSOLE_UID" ] && [ "$CONSOLE_UID" != "0" ]; then
    launchctl bootout "gui/${CONSOLE_UID}/com.runlayer.aiwatch" 2>/dev/null || true
    launchctl bootout "gui/${CONSOLE_UID}/com.runlayer.aiwatch.enroll" 2>/dev/null || true
fi

# Unload the hook bootstrap and update LaunchDaemons.
launchctl bootout "system/com.runlayer.aiwatch.bootstrap" 2>/dev/null || true
launchctl bootout "system/com.runlayer.aiwatch.update" 2>/dev/null || true

# Remove package-owned files and local state.
rm -f /usr/local/bin/aiwatch
rm -rf /usr/local/lib/runlayer/aiwatch
rm -f /Library/LaunchAgents/com.runlayer.aiwatch.plist
rm -f /Library/LaunchAgents/com.runlayer.aiwatch.enroll.plist
rm -f /Library/LaunchDaemons/com.runlayer.aiwatch.bootstrap.plist
rm -f /Library/LaunchDaemons/com.runlayer.aiwatch.update.plist
rm -f /Library/Google/Chrome/NativeMessagingHosts/com.runlayer.aiwatch.json
rm -rf /var/db/com.runlayer.aiwatch
rm -f /Library/Preferences/com.runlayer.aiwatch.version.plist
defaults delete com.runlayer.aiwatch.version 2>/dev/null || true

# Forget the installer receipt after files are removed.
pkgutil --forget com.runlayer.aiwatch 2>/dev/null || true

# Clear cached consent decisions for the package binary identifier.
tccutil reset All com.runlayer.aiwatch 2>/dev/null || true

echo "AI Watch package cleanup complete."
exit 0

Windows

Phase 1 - Disable hooks

In Settings → MDM configuration → Manage settings, set Mode to Monitor and Sessions off while AI Watch is still installed. Also update the registry fallback and disable automatic updates:

New-Item -Path "HKLM:\Software\Runlayer\AIWatch" -Force | Out-Null
New-ItemProperty -Path "HKLM:\Software\Runlayer\AIWatch" -Name "Mode" -Value "monitor" -PropertyType String -Force | Out-Null
New-ItemProperty -Path "HKLM:\Software\Runlayer\AIWatch" -Name "Enforcement" -Value 0 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path "HKLM:\Software\Runlayer\AIWatch" -Name "Sessions" -Value 0 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path "HKLM:\Software\Runlayer\AIWatch" -Name "AutoUpdate" -Value 0 -PropertyType DWord -Force | Out-Null

You can push those fallback values with an Intune script, or redeploy the app configuration with AIWATCH_MODE=monitor AIWATCH_ENFORCEMENT=0 AIWATCH_SESSIONS=0 AIWATCH_AUTO_UPDATE=0. The device-local AIWatchHooks scheduled task runs aiwatch.exe setup hooks install --mdm on its next tick (at-boot + hourly); Monitor with Sessions disabled reconciles to Detect-only and removes Runlayer hook entries while preserving third-party hooks. To force reconciliation on a device immediately, run as SYSTEM:

& "C:\Program Files\Runlayer\AIWatch\aiwatch.exe" setup hooks install --mdm
& "C:\Program Files\Runlayer\AIWatch\aiwatch.exe" setup hooks check --mdm

check should exit 0 once the device is compliant with Detect-only hook state. Stale Runlayer hook entries cause a non-zero exit until reconciliation removes them.

Phase 2 - Remove the package

In Intune:

Remove or unassign the AI Watch app.
Restart AI clients on affected devices.

Use the app uninstall command:

msiexec /x aiwatch-<version>-win-x64.msi /qn

On a true uninstall the MSI’s unregister custom action removes the entire hidden \Runlayer Task Scheduler folder (AIWatchHooks and AIWatchScan, plus any leftover legacy AIWatchScanManager / AIWatchScan-<SID> tasks), then the MSI removes C:\Program Files\Runlayer\AIWatch\ and the managed registry values under HKLM\Software\Runlayer\AIWatch. There are no separate Intune Remediation assignments to clean up.

Legacy script-based installs

For macOS fleets that used the original script-based Detect rollout, follow Legacy macOS Detect Cleanup. That page removes the old runlayer-scan wrapper, per-user LaunchAgent, old PPPC profile, and script logs while preserving unrelated user CLI state. For custom Windows script or hand-rolled Scheduled Task deployments, remove the MDM script or task assignment, then remove any custom task, script, or log paths your deployment created. The current Windows package registers its own tasks under the \Runlayer Task Scheduler folder, which the MSI uninstall removes — so this section only applies to bespoke deployments you built yourself, not the packaged MSI.

Verification

macOS

Before package cleanup, verify Phase 1 hook reconciliation. This proves AI Watch is in the desired Detect-only hook state; it does not prove the package has been removed.

if /usr/local/bin/aiwatch setup hooks check --mdm; then
    echo "PASS: AI Watch hook state compliant for Detect-only cleanup phase"
else
    echo "FAIL: hook config drift remains; keep AI Watch installed and rerun reconciliation" >&2
    exit 1
fi

After package cleanup:

#!/bin/bash
set -euo pipefail

missing_path() {
    local path="$1"
    if [ -e "$path" ]; then
        echo "FAIL: expected removed path still exists: $path" >&2
        exit 1
    fi
    echo "PASS: removed $path"
}

missing_path /usr/local/bin/aiwatch
missing_path /usr/local/lib/runlayer/aiwatch
missing_path /Library/LaunchAgents/com.runlayer.aiwatch.plist
missing_path /Library/LaunchAgents/com.runlayer.aiwatch.enroll.plist
missing_path /Library/LaunchDaemons/com.runlayer.aiwatch.bootstrap.plist
missing_path /Library/LaunchDaemons/com.runlayer.aiwatch.update.plist
missing_path /Library/Google/Chrome/NativeMessagingHosts/com.runlayer.aiwatch.json
missing_path /Library/Preferences/com.runlayer.aiwatch.version.plist

if launchctl print system/com.runlayer.aiwatch.bootstrap >/dev/null 2>&1; then
    echo "FAIL: bootstrap daemon is still loaded" >&2
    exit 1
fi
echo "PASS: bootstrap daemon unloaded"

if launchctl print system/com.runlayer.aiwatch.update >/dev/null 2>&1; then
    echo "FAIL: update daemon is still loaded" >&2
    exit 1
fi
echo "PASS: update daemon unloaded"

if pkgutil --pkg-info com.runlayer.aiwatch >/dev/null 2>&1; then
    echo "FAIL: package receipt still present" >&2
    exit 1
fi
echo "PASS: package receipt forgotten"

Windows

Before package removal, verify Phase 1 hook reconciliation. This proves AI Watch is in the desired Detect-only hook state; it does not prove the package has been removed.

& "C:\Program Files\Runlayer\AIWatch\aiwatch.exe" setup hooks check --mdm
if ($LASTEXITCODE -ne 0) {
  throw "Hook config drift remains; keep AI Watch installed and rerun reconciliation."
}
Write-Output "PASS: AI Watch hook state compliant for Detect-only cleanup phase"

After package removal:

$binaryPath = "C:\Program Files\Runlayer\AIWatch\aiwatch.exe"
if (Test-Path $binaryPath) {
  throw "AI Watch binary still exists at $binaryPath"
}
Write-Output "PASS: AI Watch binary removed"

$registryPath = "HKLM:\Software\Runlayer\AIWatch"
$managedValues = Get-ItemProperty -Path $registryPath `
  -Name "Host","OrgApiKey","Mode","Enforcement","Sessions","Version" `
  -ErrorAction SilentlyContinue

if ($null -ne $managedValues) {
  throw "Managed AI Watch registry values still exist at $registryPath"
}
Write-Output "PASS: managed AI Watch registry values removed"

$tasks = Get-ScheduledTask -TaskPath "\Runlayer\" -ErrorAction SilentlyContinue
if ($null -ne $tasks) {
  throw "AI Watch scheduled tasks still exist under \Runlayer\"
}
Write-Output "PASS: AI Watch scheduled tasks removed"

Enable

Control

Self-Hosted Deployment

Operations

Cookbook

Integrations

Connectors

Resources

Removal order

macOS

Phase 1 - Disable hooks

Phase 2 - Remove the package

Windows

Phase 1 - Disable hooks

Phase 2 - Remove the package

Legacy script-based installs

Verification

macOS

Windows

​Removal order

​macOS

​Phase 1 - Disable hooks

​Phase 2 - Remove the package

​Windows

​Phase 1 - Disable hooks

​Phase 2 - Remove the package

​Legacy script-based installs

​Verification

​macOS

​Windows

Removal order

macOS

Phase 1 - Disable hooks

Phase 2 - Remove the package

Windows

Phase 1 - Disable hooks

Phase 2 - Remove the package

Legacy script-based installs

Verification

macOS

Windows