Where apps hide your files

Locating kexts and system extensions

Updated 2026-10-28 · 6 min read

Third-party kexts are in /Library/Extensions and activated system extensions are in /Library/SystemExtensions, but neither is a folder to clear out by hand. This lists what you have and the supported way to remove each.

The locations

Kernel extensions and system extensions are different things, and they live in different places:

/Library/Extensions/                 third-party kernel extensions (.kext)
/System/Library/Extensions/          Apple's own kernel extensions (.kext)
/Library/SystemExtensions/           system extensions macOS has activated
/Library/StagedExtensions/           where macOS stages kexts awaiting approval
/System/Library/DriverExtensions/    Apple's own driver extensions (.dext)
<App>.app/Contents/Library/SystemExtensions/   a system extension inside the app that installs it

All of these folders exist on the Mac used for this guide, an Apple silicon Mac running macOS Sequoia 15.6. The last line comes from Apple's developer documentation, which says system extensions reside inside the app's Contents/Library/SystemExtensions folder. Most of these folders are owned by the system, so you can look in Finder but cannot change anything without an administrator password.

Third-party kexts are not loaded straight from /Library/Extensions. Since macOS 11 they are built into an auxiliary kernel collection. Apple's kmutil manual page says that on Apple silicon Macs this collection is kept on the Preboot volume; on Intel Macs it is in /Library/KernelCollections. On the Apple silicon Mac used for this guide, /Library/KernelCollections holds only a placeholder file.

Kernel extension or system extension?

A kernel extension (kext) runs inside the kernel. Apple no longer recommends them, and on Apple silicon a third-party kext only loads after the Mac's security is lowered in Recovery. Apple's support page gives the steps: choose Utilities > Startup Security Utility in the Recovery app, click Security Policy, select Reduced Security, then Allow user management of kernel extensions from identified developers, and restart.

A system extension is the replacement Apple offers. It runs outside the kernel, so a crash in it does not take the Mac down. System Settings groups them into four kinds (names from the settings pane's own resource file):

• Driver Extensions (DriverKit, files ending in .dext), for hardware accessories.
• Network Extensions, for VPNs, content filters and firewalls.
• Endpoint Security Extensions, for antivirus and monitoring tools.
• Camera Extensions, for external and virtual cameras.

When an app installs one, macOS asks you to allow it in System Settings. On Sequoia and later they are listed under System Settings > General > Login Items & Extensions, where Apple's guide shows a switch for each.

See what is installed (read-only)

List the system extensions macOS knows about:

systemextensionsctl list

The Mac used for this guide prints 0 extension(s). With a VPN or security tool installed you will see a row per extension with its team ID, bundle ID, version and a state. The tool's manual page names the states: activated enabled, activated waiting for user (approval pending in System Settings), activated disabled, and terminated waiting for uninstall on reboot.

List the third-party kexts that are actually loaded:

kmutil showloaded --collection aux

Only a header row (as on the Mac used for this guide) means no third-party kext is loaded. To list the kext files themselves:

ls /Library/Extensions

On the Mac used for this guide that folder holds three storage-driver kexts, yet none is loaded. A kext sitting in the folder is not necessarily doing anything, so check with kmutil before blaming it.

Removing a system extension

Do not delete anything from /Library/SystemExtensions or /System/Library/Extensions. The first is managed by macOS, and the second is on the sealed system volume.

1. Quit the app and use the vendor's own uninstaller if there is one. Security and VPN tools often need it, and some vendors ask you to switch the extension off inside the app first.
2. Otherwise, move the app to the Trash and empty it. Apple's developer documentation says the system automatically uninstalls an app's system extensions when the user deletes the app.
3. Restart, then run systemextensionsctl list again. The row should be gone, or show terminated waiting for uninstall on reboot until the next restart.

Apple's manual page for systemextensionsctl says users should not run it under most circumstances, because it is meant for developers. Its reset command removes every system extension on the Mac, so never use it as a clean-up step.

Removing a third-party kext

Use the vendor's uninstaller first. Without one, the kmutil manual page gives Apple's procedure:

1. Move the .kext out of /Library/Extensions (Finder asks for an administrator password).
2. Run kmutil rebuild in Terminal and confirm the changes to the auxiliary collection.
3. Authorise the rebuild when asked.
4. Restart, then run kmutil showloaded --collection aux to confirm it is gone.

Keep the moved kext until the Mac has restarted cleanly, and never remove anything from /System/Library/Extensions.

What not to touch

• /System/Library/Extensions: Apple's own kexts, 707 entries on the Mac used for this guide, all on the sealed system volume.
• /System/Library/KernelCollections: the prebuilt kernel collections, about 430 MB in two files on the Mac used for this guide. macOS updates replace them.
• Any extension that systemextensionsctl list shows for a security or VPN product you still use. Ripping out an endpoint tool's extension by hand can leave it half installed.

Disk space

Extensions are small. If you are hunting for space, the apps that carry them and the kernel collections are larger, and neither is something to delete.

Moving to a new Mac

Nothing here moves across. Reinstall the app that provided the extension on the new Mac and approve it again when macOS asks. A kext also needs the security change in Recovery on each Apple silicon Mac.

Why Finder search cannot find them

Spotlight and Finder searches leave out /Library, /System and the insides of app packages, so a search for kext comes back empty even when the files exist. Use Go > Go to Folder (⇧⌘G) with one of the paths above.

Finding them next time

Everywhere matches file names in system folders and inside app packages, so typing .kext lists every kernel extension bundle on the Mac and .dext lists driver extensions, including copies sitting inside an app you have not opened yet. ⌘↵ reveals one in Finder. It finds the files only; whether one is loaded is a question for systemextensionsctl and kmutil.

Common questions

Where are kernel extensions stored on a Mac?

Third-party kexts are in /Library/Extensions, and Apple's own are in /System/Library/Extensions on the sealed system volume. Approved third-party kexts load from an auxiliary kernel collection, which Apple silicon Macs keep on the Preboot volume.

How do I see which system extensions are installed?

Run systemextensionsctl list in Terminal, or on Sequoia and later look under System Settings > General > Login Items & Extensions. The command shows each extension's team ID, bundle ID and state.

How do I remove a system extension on a Mac?

Use the vendor's uninstaller, or delete the app that installed it; Apple's documentation says the system then uninstalls its system extensions. Restart and check with systemextensionsctl list.

What is the difference between a kext and a system extension?

A kext runs inside the kernel and Apple no longer recommends it. A system extension runs outside the kernel as a driver, network, endpoint security or camera extension, and a crash in it does not bring down the Mac.