> Source: [sk171012](https://support.checkpoint.com/results/sk/sk171012)

# sk171012 - Self-protection feature in Endpoint Security for macOS

| Property | Value |
|----------|-------|
| Solution ID | sk171012 |
| Date Created | 2020-12-15 |
| Last Modified | 2025-08-17 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | E89.X, E88.X |
| OS | macOS |

## Solution

### Important Notes

* When you enable self-protection, you must enter the Organizational uninstall password to uninstall or upgrade the Endpoint Security client.
* You can configure and update the Organizational password at any time.  
  Usually, an administrator configures this password before any computers are connected.
* In **E84.30** and **E84.70** this feature is disabled by default.  
  In higher releases, this feature is enabled by default.
* **This feature requires macOS 10.15 (Catalina) or higher.**

<br />

### Use the 'cpSelfProtection' utility to manage the self-protection after the Endpoint Security client installation

* The Endpoint Security client installs the '`cpSelfProtection`' utility on macOS in this directory:  
  `/Library/Application\ Support/Checkpoint/Endpoint\ Security/`
* To run this utility in the Terminal:  
  `cd /Library/Application\ Support/Checkpoint/Endpoint\ Security/`  
  `./cpSelfProtection`
* To see the built-in help, run:  
  `./cpSelfProtection -h`
* This utility can change the self-protection:
  * Temporarily (does not survive reboot):  
    `./cpSelfProtection {enable | disable}`
  * Permanently (survives reboot):  
    `./cpSelfProtection {on | off}`
* When you run this utility, you can provide the password as an argument. Remember to use single quotes around password to prevent any shell expansion.   
  If you do not enter the password as an explicit argument, this utility shows an authentication dialog.
* If you run this utility from a Terminal and you enter the password as an explicit argument, the Terminal may save the password in the history file.  
  You can remove the password from the history with this command (it prevents anything in your current session from being written to your long-term history, but does not clear out that long-term history):  
  `history -c`
* To avoid authentication dialogs during an upgrade, an MDM solution can use the utility to disable the self-protection **before** running the upgrade.
* If you run this utility from an MDM, then the script itself contains the password.  
  Remove the script from the MDM after you run it.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content