Press CTRL+K to open search

Using an unlock code to uncontain a macOS host

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

This section describes how to use the unlock code to uncontain your macOS host.

To use an unlock code to remove a macOS host from containment:

  1. Log in to the contained macOS host.

  2. Open Command line prompt and use the cd command to change to the /Library/Trellix/XCLIENT/xclient.app/Contents/MacOS/bin

    cd /Library/Trellix/XCLIENT/xclient.app/Contents/MacOS/bin

  3. Run the uncontain executable file with the unlock code:

    ./uncontain <unlock code>

Related articles
  • Using an unlock code to uncontain a macOS host
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Containing host endpoints > Manage containment > Stopping containment using an unlock code
  • Using an unlock code to uncontain a Windows host
    Endpoint Detection and Response with Forensics (EDRF) > Respond to threats with EDRF > Containment and remediation > Containing host endpoints > Manage containment > Stopping containment using an unlock code
  • Using an unlock code to uncontain a Linux host
    Endpoint Detection and Response with Forensics (EDRF) > Respond to threats with EDRF > Containment and remediation > Containing host endpoints > Manage containment > Stopping containment using an unlock code