VMware Horizon Client 2309 (8.11.0-22660933) and Wandering WiFi LLC

Findings

After upgrading some of my macOS packages using Homebrew (based on brew outdated-list), I noticed some new items under System Settings(.app) > General > Login Items > Allow in the Background.

And by “new”, I mean ”Wandering WiFi LLC”, with “3 items: 2 items affect all users”

Wandering WiFi LLC?

Question

Who is “Wandering WiFi LLC”?

Some quick Google searches for “Wandering WiFi LLC” led me to believe “Wandering WiFi LLC” was a division of AirWatch, hence (now) a part of the VMware umbrella (or should I say Broadcom? Too soon?).

Sources

“AirWatch was founded in 2003 as Wandering WiFi by John Marshall, who served as president and CEO”

“Wandering WiFi, LLC, now a division of AirWatch was founded in 2003 by John Marshall and Alan J. Dabbiere, former employees of the Manhattan Associates, a company that began installing wireless distribution and logistics networks in 1990”]

Based on that, I quickly knew that the items in question were related to upgrading the VMware Horizon Client, which I upgraded to version “2309” (8.11.0-22660933)

Based on Build numbers and versions of VMware Horizon Connection Server (2143853), I noticed it was a relatively new release (2023-10-26, which is 4-5 days since this note/post).

Version	Release Date	Build Number
Horizon 8 2309	2023-10-26	8.11.0-22629722

I then checked the release notes, mainly:

I did not find anything related to the keywords “Wandering”, “WiFi”, or “LLC”

Note that I also noticed a relevant question raised yesterday, from VMTN Communities (currently unanswered): Horizon Client and Wandering Wifi LLC - VMware Technology Network VMTN

Research new macOS background items

Well, this is how it really started; I wanted a bit more details (ok, as much as possible) from the items listed in System Settings(.app) > General > Login Items > Allow in the Background, a bit more than “just a name”, at least.

After checking the usual places first (e.g. LaunchAgents and LaunchDaemons), I still did not find any items with the keyword “Wandering”, e.g. by doing a grep -Hinr "Wandering"). I knew it was displayed in “Allow in the background”-list, hence searched for alternative ways to retrieve the list, including (possibly) more details.

I then found this thread which mentions the (not-so-very-well documented) tool sfltool

Quote

You can get much more verbose output about all startup items simultaneously on the command line with sfltool dumpbtm. The output is fairly self-explanatory, but the tool itself seems almost completely undocumented.

Objective See has a slightly more featureful and documented version that is also open source (compiled binaries can be downloaded from the release page). That tool’s README also explains the new consolidation of the various types of login items (LaunchAgents, LaunchDaemons, login items).

And by “the usual places”, this will be a good starting point, as well (same post)

Quote

In my specific case the “Allow in the Background” login items are coming from /Library/LaunchAgents

Other login related are

Applications that run on Startup

ls -lah /Library/StartupItems

Property list (plist) items running on startup

ls -lah /Library/LaunchDaemons

ls -lah /System/Library/LaunchDaemons

Applications that launch on User Login

ls -lah /Library/LaunchAgents

ls -lah ~/Library/LaunchAgents

ls -lah /System/Library/LaunchAgents

Applications that run on a set schedule

crontab -l

Kernel Extensions

kextstat

Login and Logout Hooks

defaults read com.apple.loginwindow LoginHook

defaults read com.apple.loginwindow LogoutHook

sfltool dumpbtm

Output from sfltool dumpbtm did indeed show show more details.

sudo sfltool dumpbtm

The output from sfltool was indeed much more detailed, and included exactly what I was searching for: here is (partial) output, filtering on items with name “Wandering WiFi LLC”

========================
 Records for UID -2 : FFFFEEEE-DDDD-CCCC-BBBB-AAAAFFFFFFFE
========================

 ServiceManagement migrated: true
 SharedFileList migrated: false

 Items:



#7:
                 UUID: 74394181-8CCC-4DBF-8AF1-1ACDE28AFEE8
                 Name: Wandering WiFi LLC
       Developer Name: Wandering WiFi LLC
                 Type: developer (0x20)
          Disposition: [disabled, allowed, visible, not notified] (2)
           Identifier: Wandering WiFi LLC
                  URL: (null)
           Generation: 0
  Embedded Item Identifiers:
    #1: com.vmware.deemd

 #8:
                 UUID: 61F93C2A-ED07-4E61-9BAC-ADFDE063DEED
                 Name: deemd
       Developer Name: Wandering WiFi LLC
      Team Identifier: S2ZMFGQM93
                 Type: legacy daemon (0x10010)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.vmware.deemd
                  URL: file:///Library/LaunchDaemons/com.vmware.deemd.plist
      Executable Path: /usr/local/bin/deemd
           Generation: 1
    Parent Identifier: Wandering WiFi LLC

 #9:
                 UUID: C1E9A065-C669-49D3-B71F-F28E8935FEAA
                 Name: vmwetlm
       Developer Name: Wandering WiFi LLC
      Team Identifier: S2ZMFGQM93
                 Type: legacy daemon (0x10010)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.vmware.vmwetlm
                  URL: file:///Library/LaunchDaemons/com.vmware.vmwetlm.plist
      Executable Path: /usr/local/bin/vmwetlm
           Generation: 1
    Parent Identifier: Wandering WiFi LLC

========================
 Records for UID 0 : FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000000
========================

 ServiceManagement migrated: false
 SharedFileList migrated: false

 Items:
 
#4:
                 UUID: 74394181-8CCC-4DBF-8AF1-1ACDE28AFEE8
                 Name: Wandering WiFi LLC
       Developer Name: Wandering WiFi LLC
                 Type: developer (0x20)
          Disposition: [disabled, allowed, visible, not notified] (2)
           Identifier: Wandering WiFi LLC
                  URL: (null)
           Generation: 2

========================
 Records for UID 501 : 94AE2ED3-7EA3-449C-8732-1B9335873667
========================

 ServiceManagement migrated: true
 SharedFileList migrated: true

 Items:


#34:
                 UUID: E9DC8099-6164-4A2C-9D1B-318CFB96DD35
                 Name: Wandering WiFi LLC
       Developer Name: Wandering WiFi LLC
                 Type: developer (0x20)
          Disposition: [disabled, allowed, visible, not notified] (2)
           Identifier: Wandering WiFi LLC
                  URL: (null)
           Generation: 1

#35:
                 UUID: 56B3FB34-734F-4CF0-A052-DFDB7DDA56A4
                 Name: MacUIEvents
       Developer Name: Wandering WiFi LLC
      Team Identifier: S2ZMFGQM93
                 Type: legacy agent (0x10008)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.vmware.deem.MacUIEvents
                  URL: file:///Library/LaunchAgents/com.vmware.deem.MacUIEvents.plist
      Executable Path: /usr/local/bin/MacUIEvents
           Generation: 1
    Parent Identifier: Wandering WiFi LLC

🕵🏻‍♂️ From the output above, two identifiers was of main interest for further details; com.vmware.deemd and com.vmware.vmwetlm

#8:
                 UUID: 61F93C2A-ED07-4E61-9BAC-ADFDE063DEED
                 Name: deemd
       Developer Name: Wandering WiFi LLC
      Team Identifier: S2ZMFGQM93
                 Type: legacy daemon (0x10010)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.vmware.deemd
                  URL: file:///Library/LaunchDaemons/com.vmware.deemd.plist
      Executable Path: /usr/local/bin/deemd
           Generation: 1
    Parent Identifier: Wandering WiFi LLC

 #9:
                 UUID: C1E9A065-C669-49D3-B71F-F28E8935FEAA
                 Name: vmwetlm
       Developer Name: Wandering WiFi LLC
      Team Identifier: S2ZMFGQM93
                 Type: legacy daemon (0x10010)
          Disposition: [enabled, allowed, visible, notified] (11)
           Identifier: com.vmware.vmwetlm
                  URL: file:///Library/LaunchDaemons/com.vmware.vmwetlm.plist
      Executable Path: /usr/local/bin/vmwetlm
           Generation: 1
    Parent Identifier: Wandering WiFi LLC

DEEM and vmwetlm?

`com.vmware.deem` is?

Guestimate: Digital Employee Experience Management (DEEM)?

Based on https://www.vmware.com/nordics/products/workspace-one/digital-employee-experience-management.html

Digital Employee Experience Management (DEEM) is an end user experience management software that empowers you to measure, analyze and remediate employee experience, from anywhere and on any device. By leveraging machine learning (ML) models, DEEM enables you to move from reactive to proactive IT, cut through the noise and focus on what matters most.

`com.vmware.vmwetlm` is?

Guestimate: VMware Experience Management Service

Based on https://docs.vmware.com/en/VMware-Workspace-ONE-Intelligence/services/intelligence-documentation/GUID-IntelExperienceManagement.html

One way to troubleshoot issues with sending data to Workspace ONE Intelligence is to ensure the Workspace ONE Intelligent Hub or the DEEM Telemetry Agent for Windows is running on the Windows device. The DEEM Telemetry Agent includes two services.

Service Name Service Display Name
VMWOSQEXT VMware Digital Experience Telemetry
vmwetlm VMware Experience Management Service

Service Name	Service Display Name
VMWOSQEXT	VMware Digital Experience Telemetry
vmwetlm	VMware Experience Management Service

Uninstall scripts

Even though telemetry might be needed (and useful!) in many cases, I wanted to see if it was possible to uninstall the new background services, without (totally) breaking the VMware Horizon Client

I also noticed that the vmwetlm process was running in the background on macOS, even while the Horizon Client was fully closed (not connected to any Horizon Services). So new background services possibly burning precious (and unneeded) CPU cycles, increasing my carbon footprint, etc.

ps -ef 3067
  UID   PID  PPID   C STIME   TTY           TIME CMD
    0  3067     1   0  7:10PM ??         0:00.21 /usr/local/bin/vmwetlm

Research on (possible) footprint?

Quote source: Experience Management

What is the Experience Management footprint on your devices?

The footprint is comparatively small. The tested configurations for Experience Management suggest a periodic impact of up to 5% CPU usage for a typical 4 core CPU. Tested configurations also suggest 10 to 40 Mb of memory usage on each Windows or macOS device.

While searching the package files, we can (finally) see some uninstall.sh scripts. Let’s try them out!

Trying to remove vmwetlm

ls -hal "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm"
Permissions Size User Date Modified Name
drwxr-xr-x     - root 31 Oct 19:10   .
drwxr-xr-x     - root 11 Oct 03:17   ..
.rwxr-xr-x@ 3.4k root 11 Oct 03:17   collectLogs.sh
.rwxr-xr-x@  198 root 11 Oct 03:17   config.ini
.rwxr-xr-x  8.8M root 11 Oct 03:17   etlmapi.dylib
.rwxr-xr-x  1.4M root 11 Oct 03:17   tlmtool
.rwxr-xr-x@ 8.3k root 11 Oct 03:17   uninstall.sh
.rwxr-xr-x   21M root 11 Oct 03:17   vmwetlm

Script

sudo sh "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm/uninstall.sh"

Trying out the uninstall script…

❯ sudo sh "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm/uninstall.sh"
Password:
Welcome to Application Uninstaller
Disable Mix mode if uninstallation is VMware.Deem.
There are other installation items, will keep the package.
Updated installation config file and quit uninstallation.

👎 Well, that did not go well, notice:

There are other installation items, will keep the package.

Let’s try to remove deem first, then debug vmwetlm more later.

Files:

❯ ls -hal "/Library/Application Support/VMware/VMware.Deem/deem"
Permissions Size User Date Modified Name
drwxr-xr-x     - root 31 Oct 19:10   .
drwxr-xr-x     - root 31 Oct 19:10   ..
drwxr-xr-x     - root 11 Oct 03:39   cs
drwxr-xr-x     - root 11 Oct 03:39   de
drwxr-xr-x     - root 11 Oct 03:39   es
drwxr-xr-x     - root 11 Oct 03:39   fr
drwxr-xr-x     - root 11 Oct 03:39   it
drwxr-xr-x     - root 11 Oct 03:39   ja
drwxr-xr-x     - root 11 Oct 03:39   ko
drwxr-xr-x     - root 11 Oct 03:39   native_bin
drwxr-xr-x     - root 11 Oct 03:39   pl
drwxr-xr-x     - root 11 Oct 03:39   pt-BR
drwxr-xr-x     - root 11 Oct 03:39   ru
drwxr-xr-x     - root 11 Oct 03:39   tr
drwxr-xr-x     - root 11 Oct 03:39   zh-Hans
drwxr-xr-x     - root 11 Oct 03:39   zh-Hant
.rwxr-xr-x   405 root 11 Oct 03:20   appsettings.Development.json
.rwxr-xr-x  2.6k root 11 Oct 03:20   appsettings.json
.rwxr-xr-x   138 root 11 Oct 03:20   appsettings.Sandbox.json
.rwxr-xr-x@ 4.8k root 11 Oct 03:39   archive_logs.command
.rwxr-xr-x  176k root 23 Jun 18:54   CliWrap.dll
.rwxr-xr-x  173k root 11 Oct 03:39   createdump
.rwxr-xr-x  149k root 11 Oct 03:39   deemd
.rwxr-xr-x  448k root 11 Oct 03:39   Google.Protobuf.dll
.rwxr-xr-x  2.4M root 11 Oct 03:39   libclrjit.dylib
.rwxr-xr-x  6.8M root 11 Oct 03:39   libcoreclr.dylib
.rwxr-xr-x  646k root 11 Oct 03:39   libdbgshim.dylib
.rwxr-xr-x  1.1M root 11 Oct 03:39   libe_sqlite3.dylib
.rwxr-xr-x  442k root 11 Oct 03:39   libhostfxr.dylib
.rwxr-xr-x  421k root 11 Oct 03:39   libhostpolicy.dylib
.rwxr-xr-x  2.5M root 11 Oct 03:39   libmscordaccore.dylib
.rwxr-xr-x  1.9M root 11 Oct 03:39   libmscordbi.dylib
lrwxr-xr-x    47 root 31 Oct 19:10   libOsqueryDataSource.dylib -> native_bin/osx-arm64/libOsqueryDataSource.dylib
.rwxr-xr-x  156k root 11 Oct 03:39   libSystem.Globalization.Native.dylib
.rwxr-xr-x  839k root 11 Oct 03:39   libSystem.IO.Compression.Native.dylib
.rwxr-xr-x  143k root 11 Oct 03:39   libSystem.Native.dylib
.rwxr-xr-x   72k root 11 Oct 03:39   libSystem.Net.Security.Native.dylib
.rwxr-xr-x  105k root 11 Oct 03:39   libSystem.Security.Cryptography.Native.Apple.dylib
.rwxr-xr-x  227k root 11 Oct 03:39   libSystem.Security.Cryptography.Native.OpenSsl.dylib
.rwxr-xr-x  928k root 11 Oct 03:39   MacUIEvents
.rwxr-xr-x  298k root 11 Oct 03:39   Microsoft.CSharp.dll
.rwxr-xr-x  171k root  9 Aug 18:36   Microsoft.Data.Sqlite.dll
.rwxr-xr-x   35k root  9 Aug 18:35   Microsoft.EntityFrameworkCore.Abstractions.dll
.rwxr-xr-x  2.1M root  9 Aug 18:35   Microsoft.EntityFrameworkCore.dll
.rwxr-xr-x  1.8M root  9 Aug 18:35   Microsoft.EntityFrameworkCore.Relational.dll
.rwxr-xr-x  205k root  9 Aug 18:36   Microsoft.EntityFrameworkCore.Sqlite.dll
.rwxr-xr-x   21k root 11 Oct 03:39   Microsoft.Extensions.Caching.Abstractions.dll
.rwxr-xr-x   33k root 11 Oct 03:39   Microsoft.Extensions.Caching.Memory.dll
.rwxr-xr-x   18k root 11 Oct 03:39   Microsoft.Extensions.Configuration.Abstractions.dll
.rwxr-xr-x   32k root 11 Oct 03:39   Microsoft.Extensions.Configuration.Binder.dll
.rwxr-xr-x   15k root 11 Oct 03:39   Microsoft.Extensions.Configuration.CommandLine.dll
.rwxr-xr-x   30k root 11 Oct 03:39   Microsoft.Extensions.Configuration.dll
.rwxr-xr-x   11k root 11 Oct 03:39   Microsoft.Extensions.Configuration.EnvironmentVariables.dll
.rwxr-xr-x   18k root 11 Oct 03:39   Microsoft.Extensions.Configuration.FileExtensions.dll
.rwxr-xr-x   17k root 11 Oct 03:39   Microsoft.Extensions.Configuration.Json.dll
.rwxr-xr-x   15k root 11 Oct 03:39   Microsoft.Extensions.Configuration.UserSecrets.dll
.rwxr-xr-x   34k root 11 Oct 03:39   Microsoft.Extensions.DependencyInjection.Abstractions.dll
.rwxr-xr-x   74k root 11 Oct 03:39   Microsoft.Extensions.DependencyInjection.dll
.rwxr-xr-x   70k root 11 Oct 03:39   Microsoft.Extensions.DependencyModel.dll
.rwxr-xr-x   13k root 11 Oct 03:39   Microsoft.Extensions.FileProviders.Abstractions.dll
.rwxr-xr-x   34k root 11 Oct 03:39   Microsoft.Extensions.FileProviders.Physical.dll
.rwxr-xr-x   36k root 11 Oct 03:39   Microsoft.Extensions.FileSystemGlobbing.dll
.rwxr-xr-x   23k root 11 Oct 03:39   Microsoft.Extensions.Hosting.Abstractions.dll
.rwxr-xr-x   56k root 11 Oct 03:39   Microsoft.Extensions.Hosting.dll
.rwxr-xr-x   56k root 11 Oct 03:39   Microsoft.Extensions.Http.dll
.rwxr-xr-x   53k root 11 Oct 03:39   Microsoft.Extensions.Logging.Abstractions.dll
.rwxr-xr-x   17k root 11 Oct 03:39   Microsoft.Extensions.Logging.Configuration.dll
.rwxr-xr-x   49k root 11 Oct 03:39   Microsoft.Extensions.Logging.Console.dll
.rwxr-xr-x   11k root 11 Oct 03:39   Microsoft.Extensions.Logging.Debug.dll
.rwxr-xr-x   37k root 11 Oct 03:39   Microsoft.Extensions.Logging.dll
.rwxr-xr-x   16k root 11 Oct 03:39   Microsoft.Extensions.Logging.EventLog.dll
.rwxr-xr-x   25k root 11 Oct 03:39   Microsoft.Extensions.Logging.EventSource.dll
.rwxr-xr-x   14k root 11 Oct 03:39   Microsoft.Extensions.ObjectPool.dll
.rwxr-xr-x   13k root 11 Oct 03:39   Microsoft.Extensions.Options.ConfigurationExtensions.dll
.rwxr-xr-x   51k root 11 Oct 03:39   Microsoft.Extensions.Options.dll
.rwxr-xr-x   32k root 11 Oct 03:39   Microsoft.Extensions.Primitives.dll
.rwxr-xr-x  9.2k root 11 Oct 03:39   Microsoft.IdentityModel.Abstractions.dll
.rwxr-xr-x  123k root 29 Sep 04:55   Microsoft.IdentityModel.JsonWebTokens.dll
.rwxr-xr-x   26k root 11 Oct 03:39   Microsoft.IdentityModel.Logging.dll
.rwxr-xr-x  284k root 29 Sep 05:03   Microsoft.IdentityModel.Tokens.dll
.rwxr-xr-x  7.7k root 11 Oct 03:39   Microsoft.Win32.Primitives.dll
.rwxr-xr-x  8.2k root 11 Oct 03:39   netstandard.dll
.rwxr-xr-x  712k root  8 Mar 08:09   Newtonsoft.Json.dll
.rwxr-xr-x  139k root 11 Oct 03:39   Serilog.dll
.rwxr-xr-x   30k root 11 May 02:31   Serilog.Extensions.Hosting.dll
.rwxr-xr-x   30k root 11 May 00:47   Serilog.Extensions.Logging.dll
.rwxr-xr-x  8.7k root 17 Oct  2019   Serilog.Formatting.Compact.dll
.rwxr-xr-x   77k root 23 Aug 03:02   Serilog.Settings.Configuration.dll
.rwxr-xr-x   31k root 25 Jun  2021   Serilog.Sinks.File.dll
.rwxr-xr-x   19k root 27 Sep  2022   Serilog.Sinks.PeriodicBatching.dll
.rwxr-xr-x   39k root  4 Oct 05:23   Serilog.Sinks.Seq.dll
.rwxr-xr-x  5.1k root 23 Aug 20:41   SQLitePCLRaw.batteries_v2.dll
.rwxr-xr-x   51k root 23 Aug 20:38   SQLitePCLRaw.core.dll
.rwxr-xr-x   36k root 23 Aug 20:38   SQLitePCLRaw.provider.e_sqlite3.dll
.rwxr-xr-x   76k root 11 Oct 03:39   System.Collections.Concurrent.dll
.rwxr-xr-x   92k root 11 Oct 03:39   System.Collections.dll
.rwxr-xr-x  180k root 11 Oct 03:39   System.Collections.Immutable.dll
.rwxr-xr-x   36k root 11 Oct 03:39   System.Collections.NonGeneric.dll
.rwxr-xr-x   35k root 11 Oct 03:39   System.Collections.Specialized.dll
.rwxr-xr-x   83k root 11 Oct 03:39   System.ComponentModel.Annotations.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.ComponentModel.dll
.rwxr-xr-x   16k root 11 Oct 03:39   System.ComponentModel.EventBasedAsync.dll
.rwxr-xr-x   31k root 11 Oct 03:39   System.ComponentModel.Primitives.dll
.rwxr-xr-x  283k root 11 Oct 03:39   System.ComponentModel.TypeConverter.dll
.rwxr-xr-x   74k root 11 Oct 03:39   System.Console.dll
.rwxr-xr-x  987k root 11 Oct 03:39   System.Data.Common.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Diagnostics.Debug.dll
.rwxr-xr-x  139k root 11 Oct 03:39   System.Diagnostics.DiagnosticSource.dll
.rwxr-xr-x   39k root 11 Oct 03:39   System.Diagnostics.EventLog.dll
.rwxr-xr-x   97k root 11 Oct 03:39   System.Diagnostics.Process.dll
.rwxr-xr-x   15k root 11 Oct 03:39   System.Diagnostics.StackTrace.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Diagnostics.Tools.dll
.rwxr-xr-x   44k root 11 Oct 03:39   System.Diagnostics.TraceSource.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.Diagnostics.Tracing.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.Drawing.dll
.rwxr-xr-x   51k root 11 Oct 03:39   System.Drawing.Primitives.dll
.rwxr-xr-x   69k root 11 Oct 03:39   System.Formats.Asn1.dll
.rwxr-xr-x   82k root 29 Sep 04:53   System.IdentityModel.Tokens.Jwt.dll
.rwxr-xr-x   28k root 11 Oct 03:39   System.IO.Compression.Brotli.dll
.rwxr-xr-x   96k root 11 Oct 03:39   System.IO.Compression.dll
.rwxr-xr-x   13k root 11 Oct 03:39   System.IO.FileSystem.dll
.rwxr-xr-x   42k root 11 Oct 03:39   System.IO.FileSystem.Watcher.dll
.rwxr-xr-x   34k root 11 Oct 03:39   System.IO.MemoryMappedFiles.dll
.rwxr-xr-x   52k root 11 Oct 03:39   System.IO.Pipes.dll
.rwxr-xr-x  143k root 11 Oct 03:39   System.Linq.dll
.rwxr-xr-x  557k root 11 Oct 03:39   System.Linq.Expressions.dll
.rwxr-xr-x   81k root 11 Oct 03:39   System.Linq.Queryable.dll
.rwxr-xr-x   52k root 11 Oct 03:39   System.Memory.dll
.rwxr-xr-x  633k root 11 Oct 03:39   System.Net.Http.dll
.rwxr-xr-x   34k root 11 Oct 03:39   System.Net.NameResolution.dll
.rwxr-xr-x   65k root 11 Oct 03:39   System.Net.NetworkInformation.dll
.rwxr-xr-x   85k root 11 Oct 03:39   System.Net.Primitives.dll
.rwxr-xr-x  114k root 11 Oct 03:39   System.Net.Quic.dll
.rwxr-xr-x  133k root 11 Oct 03:39   System.Net.Requests.dll
.rwxr-xr-x  240k root 11 Oct 03:39   System.Net.Security.dll
.rwxr-xr-x  205k root 11 Oct 03:39   System.Net.Sockets.dll
.rwxr-xr-x   38k root 11 Oct 03:39   System.ObjectModel.dll
.rwxr-xr-x   12M root 25 Aug 04:38   System.Private.CoreLib.dll
.rwxr-xr-x  777k root 11 Oct 03:39   System.Private.DataContractSerialization.dll
.rwxr-xr-x   90k root 11 Oct 03:39   System.Private.Uri.dll
.rwxr-xr-x  3.1M root 11 Oct 03:39   System.Private.Xml.dll
.rwxr-xr-x  143k root 11 Oct 03:39   System.Private.Xml.Linq.dll
.rwxr-xr-x   25k root 11 Oct 03:39   System.Reflection.DispatchProxy.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Reflection.Emit.ILGeneration.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Reflection.Emit.Lightweight.dll
.rwxr-xr-x  443k root 11 Oct 03:39   System.Reflection.Metadata.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Reflection.Primitives.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Resources.ResourceManager.dll
.rwxr-xr-x  6.1k root 11 Oct 03:39   System.Runtime.CompilerServices.Unsafe.dll
.rwxr-xr-x   17k root 11 Oct 03:39   System.Runtime.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Runtime.Extensions.dll
.rwxr-xr-x   25k root 11 Oct 03:39   System.Runtime.InteropServices.dll
.rwxr-xr-x   11k root 11 Oct 03:39   System.Runtime.InteropServices.RuntimeInformation.dll
.rwxr-xr-x   69k root 11 Oct 03:39   System.Runtime.Numerics.dll
.rwxr-xr-x  123k root 11 Oct 03:39   System.Runtime.Serialization.Formatters.dll
.rwxr-xr-x   11k root 11 Oct 03:39   System.Runtime.Serialization.Primitives.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.Runtime.Serialization.Xml.dll
.rwxr-xr-x   35k root 11 Oct 03:39   System.Security.AccessControl.dll
.rwxr-xr-x   41k root 11 Oct 03:39   System.Security.Claims.dll
.rwxr-xr-x  237k root 11 Oct 03:39   System.Security.Cryptography.Algorithms.dll
.rwxr-xr-x   32k root 11 Oct 03:39   System.Security.Cryptography.Cng.dll
.rwxr-xr-x   45k root 11 Oct 03:39   System.Security.Cryptography.Csp.dll
.rwxr-xr-x   46k root 11 Oct 03:39   System.Security.Cryptography.Encoding.dll
.rwxr-xr-x  237k root 11 Oct 03:39   System.Security.Cryptography.Pkcs.dll
.rwxr-xr-x   53k root 11 Oct 03:39   System.Security.Cryptography.Primitives.dll
.rwxr-xr-x  284k root 11 Oct 03:39   System.Security.Cryptography.X509Certificates.dll
.rwxr-xr-x  162k root 11 Oct 03:39   System.Security.Cryptography.Xml.dll
.rwxr-xr-x   21k root 11 Oct 03:39   System.Security.Principal.Windows.dll
.rwxr-xr-x  2.4M root  3 May 23:06   System.ServiceModel.Primitives.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Text.Encoding.Extensions.dll
.rwxr-xr-x   60k root 11 Oct 03:39   System.Text.Encodings.Web.dll
.rwxr-xr-x  532k root 11 Oct 03:39   System.Text.Json.dll
.rwxr-xr-x  180k root 11 Oct 03:39   System.Text.RegularExpressions.dll
.rwxr-xr-x   41k root 11 Oct 03:39   System.Threading.Channels.dll
.rwxr-xr-x   34k root 11 Oct 03:39   System.Threading.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Threading.Overlapped.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.Threading.Tasks.dll
.rwxr-xr-x   49k root 11 Oct 03:39   System.Threading.Tasks.Parallel.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Threading.Thread.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Threading.ThreadPool.dll
.rwxr-xr-x  142k root 11 Oct 03:39   System.Transactions.Local.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Xml.Linq.dll
.rwxr-xr-x  6.7k root 11 Oct 03:39   System.Xml.ReaderWriter.dll
.rwxr-xr-x  5.1k root 11 Oct 03:39   System.Xml.XDocument.dll
.rwxr-xr-x  5.6k root 11 Oct 03:39   System.Xml.XmlSerializer.dll
.rwxr-xr-x@ 3.0k root 11 Oct 03:39   uninstall.sh
.rwxr-xr-x  241k root 11 Oct 03:38   VMware.Deem.Common.dll
.rwxr-xr-x   96k root 11 Oct 03:38  謹 VMware.Deem.Common.xml
.rwxr-xr-x   81k root 11 Oct 03:39   VMware.Deem.deps.json
.rwxr-xr-x   50k root 11 Oct 03:38   VMware.Deem.dll
.rwxr-xr-x  192k root 11 Oct 03:38   VMware.Deem.MacOS.dll
.rwxr-xr-x   122 root 11 Oct 03:20   VMware.Deem.MacOS.runtimeconfig.json
.rwxr-xr-x   66k root 11 Oct 03:38  謹 VMware.Deem.MacOS.xml
.rwxr-xr-x  1.1k root 11 Oct 03:38   VMware.Deem.runtimeconfig.json
.rwxr-xr-x  3.7k root 11 Oct 03:38  謹 VMware.Deem.xml

Uninstall script

sudo sh "/Library/Application Support/VMware/VMware.Deem/deem/uninstall.sh"

Trying out the uninstall script…

Welcome to Application Uninstaller
The following packages will be REMOVED:
  VMware.Deem-23.06.15.30
Stopping the agent: MacUIEvents
Unload failed: 5: Input/output error
Try running `launchctl bootout` as root for richer errors.
Stopping the daemon: deemd
Application uninstalling process started
[1/4] [DONE] Successfully deleted shortcut links
[2/4] [DONE] Successfully deleted application informations
[2/4] [DONE] Successfully deleted application informations
[3/4] [DONE] Successfully deleted application
[4/4] [DONE] Successfully deleted logs
Application uninstall process finished

👍 daemon and service successfully deleted.

Continue debugging “VMware.EndpointTelemetryService/vmwetlm/uninstall.sh” script

So we got this

❯ sudo sh "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm/uninstall.sh"
Password:
Welcome to Application Uninstaller
Disable Mix mode if uninstallation is VMware.Deem.
There are other installation items, will keep the package.
Updated installation config file and quit uninstallation.

From line 181

nvim "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm/uninstall.sh" +181

    if [[ $(/usr/libexec/PlistBuddy -c "Print Installation" ${plist_path} | grep -c ".*") -lt 3 ]]; then
        echo "No other installation item left, will remove the package."
        return 0
    else
        echo "There are other installation items, will keep the package."
        return 1
    fi

So the check resulting in failure being:

/usr/libexec/PlistBuddy -c "Print Installation" ${plist_path} | grep -c ".*") -lt 3

plist_path is?

Line 153

local plist_path=${CONFIG_PATH}/${INSTALL_CONF}

${CONFIG_PATH}/${INSTALL_CONF} is?

Line 135-137

CONFIG_PATH="/etc/vmware/vmwetlm/config"
INSTALL_CONF="install.plist"
SETTING_CONF="/var/vmware/vmwetlm/deem-tlm.conf"

So the command is (after variables translated)

/usr/libexec/PlistBuddy -c "Print Installation" /etc/vmware/vmwetlm/config/install.plist | grep -c ".*"

grep -c is?

 -c, --count
             Only a count of selected lines is written to standard output.

Testing

/usr/libexec/PlistBuddy -c "Print Installation" /etc/vmware/vmwetlm/config/install.plist | grep -c ".*"
3

/usr/libexec/PlistBuddy -c "Print Installation" /etc/vmware/vmwetlm/config/install.plist
Array {
    VMware.HorizonClient
}

So, array listing VMware.HorizonClient. No go.

I then found on line 160

if [ "$FORCE_UNINSTALL" -eq 1 ]; then
	echo "Force to uninstall Telemetry Services."
	return 0
fi

And on lines 124-133

if [ -z "$1" ]; then
    # In Hub UEM DEEM scenario, there's no value input as parameter. 
    UNINSTALL_SOURCE="VMware.Deem"
else
    if [ "$1" = "--force" ]; then
        FORCE_UNINSTALL=1
    else
        UNINSTALL_SOURCE=$1
    fi
fi

sudo sh "/Library/Application Support/VMware/VMware.EndpointTelemetryService/vmwetlm/uninstall.sh" --force
Welcome to Application Uninstaller
Force to uninstall Telemetry Services.
The following packages will be REMOVED:
  VMware.EndpointTelemetryService-23.6.2.16
Stopping the daemon: vmwetlm
Application uninstalling process started
[1/5] [DONE] Successfully deleted shortcut links
[2/5] [DONE] Successfully deleted application informations
[3/5] [DONE] Successfully deleted application
[4/5] [DONE] Successfully deleted logs
[5/5] [DONE] Successfully deleted conf files
Application uninstall process finished

👍 daemon stopped and deleted.

The mentioned items from System Settings(.app) > General > Login Items > Allow in the Background are gone as well.

Question

Guess the next step should be researching the side effects of removing telemetry services(?), e.g. from an admin perspective (cause I also have Horizon Servers, and I like telemetry data… sometimes).

🪴 espenodegaard

Explorer

VMware Horizon Client 2309 (8.11.0-22660933) and Wandering WiFi LLC

Findings

Wandering WiFi LLC?

Research new macOS background items

sfltool dumpbtm

DEEM and vmwetlm?

`com.vmware.deem` is?

`com.vmware.vmwetlm` is?

Uninstall scripts

What is the Experience Management footprint on your devices?

Graph View

Table of Contents

Backlinks

Recent articles

Network Time Protocol

SexiGraf

VMware ESXi Scratch Partition

🪴 espenodegaard

Explorer

VMware Horizon Client 2309 (8.11.0-22660933) and Wandering WiFi LLC

Findings §

Wandering WiFi LLC? §

Research new macOS background items §

sfltool dumpbtm §

DEEM and vmwetlm? §

com.vmware.deem is? §

com.vmware.vmwetlm is? §

Uninstall scripts §

What is the Experience Management footprint on your devices? §

Graph View

Table of Contents

Backlinks

Recent articles

Network Time Protocol

SexiGraf

VMware ESXi Scratch Partition

Findings

Wandering WiFi LLC?

Research new macOS background items

sfltool dumpbtm

DEEM and vmwetlm?

`com.vmware.deem` is?

`com.vmware.vmwetlm` is?

Uninstall scripts

What is the Experience Management footprint on your devices?