“Cisco Secure Client is already installed.”

Why it happens

Run these in Terminal, in order. You will be asked for your administrator password. Step 02 is the one that clears the error; the rest is what stops it coming back.

1. 01

   Run Cisco's own uninstaller first

   Cisco ships an uninstall script for every module. If any part of the client is still on disk, this is the cleanest way to take it off. Run the full uninstaller, then the per module scripts for anything that was installed alongside the VPN.

   sudo /opt/cisco/secureclient/bin/cisco_secure_client_uninstall.sh
   
   # Older installs live under the anyconnect path instead:
   sudo /opt/cisco/anyconnect/bin/anyconnect_uninstall.sh
   
   # Per module, if the full script is missing:
   sudo /opt/cisco/secureclient/bin/vpn_uninstall.sh
   sudo /opt/cisco/secureclient/bin/dart_uninstall.sh
   sudo /opt/cisco/secureclient/bin/umbrella_uninstall.sh
   sudo /opt/cisco/secureclient/bin/iseposture_uninstall.sh
   sudo /opt/cisco/secureclient/bin/websecurity_uninstall.sh
   sudo /opt/cisco/secureclient/bin/amp_uninstall.sh

   A “no such file or directory” here is fine. It means that module is already gone, or the app was dragged to the Trash instead of uninstalled, which is how most people arrive at this error in the first place.

2. 02

   Make macOS forget the package receipts

   This is the step that actually clears the error. The installer does not look for the app, it looks for a receipt: a record in the macOS package database saying a version is already present. Deleting the app never touches that record, so the installer keeps refusing. List every Cisco receipt, then forget each one.

   pkgutil --pkgs | grep -i cisco
   
   # Forget each ID the command above prints, for example:
   sudo pkgutil --forget com.cisco.pkg.anyconnect.vpn
   sudo pkgutil --forget com.cisco.pkg.secureclient.gui
   sudo pkgutil --forget com.cisco.pkg.anyconnect.dart
   sudo pkgutil --forget com.cisco.pkg.anyconnect.posture
   sudo pkgutil --forget com.cisco.pkg.anyconnect.nvm
   sudo pkgutil --forget com.cisco.pkg.anyconnect.umbrella
   
   # Or forget them all in one pass:
   pkgutil --pkgs | grep -i cisco | while read id; do sudo pkgutil --forget "$id"; done

   The exact receipt IDs vary by version and by which modules your organization packaged, which is why the grep matters more than the list. Forgetting a receipt removes only the record, never your files.

3. 03

   Remove the files left on disk

   Receipts are usually enough to let the installer run, but leftover binaries, preference files and profiles will make the new version behave strangely after it installs. Clear them before you reinstall, not after.

   sudo rm -rf /opt/cisco
   sudo rm -rf "/Applications/Cisco"
   sudo rm -rf "/Applications/Cisco Secure Client.app"
   sudo rm -rf "/Library/Application Support/Cisco"
   sudo rm -rf /Library/Logs/Cisco
   rm -rf ~/.anyconnect
   rm -rf ~/Library/Preferences/com.cisco.anyconnect.gui.plist
   rm -rf "$HOME/Library/Application Support/Cisco"

   If your organization pushes a VPN profile, it lives under /opt/cisco and goes with this step. You will need the profile or the server address again before you can connect, so note it down first.

4. 04

   Unload the launch daemons and agents

   The VPN agent runs as a root daemon and the interface runs as a per user agent. If either is still loaded, the installer can fail with a different error, or the new client will start against the old agent.

   sudo launchctl bootout system/com.cisco.secureclient.vpnagentd 2>/dev/null
   sudo launchctl bootout system/com.cisco.anyconnect.vpnagentd 2>/dev/null
   
   sudo rm -f /Library/LaunchDaemons/com.cisco.*.plist
   sudo rm -f /Library/LaunchAgents/com.cisco.*.plist
   rm -f ~/Library/LaunchAgents/com.cisco.*.plist

5. 05

   Check for a leftover system extension

   Cisco Secure Client 5.x installs a system extension. On some machines the extension survives an uninstall and blocks the next install, or leaves the new client unable to bring up a tunnel. List what is registered and confirm nothing from Cisco remains.

   systemextensionsctl list

   If a Cisco extension is still listed as activated or terminated waiting on user, a restart normally clears it. On a managed Mac the extension is approved by profile, so removing it may need your administrator.

6. 06

   Restart, then install

   Restart the Mac. This is not superstition: it clears the unloaded daemons, settles any pending system extension state, and is the difference between a clean install and a second round of this same error. Then run the installer again.

Confirm it is actually gone

Before you run the installer again, these three should all come back empty. If any of them returns a line, something was missed and the install will fail the same way.

pkgutil --pkgs | grep -i cisco
ls /opt/cisco 2>/dev/null
sudo launchctl list | grep -i cisco

Questions from the field

Why does the installer say it is already installed when I deleted the app?

Because the installer checks the macOS package receipt database, not your Applications folder. Dragging Cisco Secure Client to the Trash removes the app bundle and leaves the receipt, the files under /opt/cisco, and the launch daemons exactly where they were. The installer reads the receipt, decides a copy is present, and refuses. Forgetting the receipt with pkgutil is what clears it.

Is running pkgutil --forget safe?

Yes. It removes the installer's record that a package was installed. It does not delete files, does not touch your data, and cannot break another application. The only consequence is that macOS no longer knows which files belonged to that package, which is why step 03 removes them by hand.

Does this work for AnyConnect as well as Secure Client?

Yes. Cisco Secure Client is the current name for what was AnyConnect Secure Mobility Client, and the failure is identical. The difference is the paths: older AnyConnect installs live under /opt/cisco/anyconnect, Secure Client 5.x lives under /opt/cisco/secureclient. Both sets of commands are above.

I got “Operation not permitted” on one of the rm commands.

That is System Integrity Protection or Full Disk Access, not a Cisco problem. Give Terminal Full Disk Access in System Settings, Privacy and Security, Full Disk Access, then run the command again. Do not disable SIP for this.

Will this remove my company's VPN profile?

Yes. Profiles live under /opt/cisco and are removed in step 03. Most organizations push the profile again automatically after you reinstall, but if yours does not, ask your help desk for the profile or the VPN server address before you start.

Do I need to buy anything to fix this?

No. Every command on this page is complete and free. VPN Client Repair exists because doing this by hand across a queue of machines is slow, and because one missed receipt sends you around the loop again. It is a convenience, not a paywall.