GitHub
05/11/2026, 9:45 PMdarwin) using the quick-enroll oneliner, if osqueryd is already running, the process is not stopped and there is the following error:
[+] Starting com.facebook.osqueryd
/Library/LaunchDaemons/com.facebook.osqueryd.plist: service already loaded
This seems because the current script uses unload instead of stop && unload for the launchd service.
Thanks @ewaher for finding this!
jmpsec/osctrlGitHub
05/11/2026, 9:45 PM