This is what I have come up with "SELECT identifier FROM system_extensions WHERE category LIKE ‘%com.apple.system_extension.endpoint_security%' and state = ‘activated_enabled’;" Just want to make sure it's OK.