SentinelOne Security Software Disables Keyboard Maestro Engine

Questions & Suggestions
1

Hello,

I downloaded the trial of Keyboard Maestro to run shortcuts in my audio DAW. The engine is unable to launch at all when looking at the contents of Keyboard Maestro.app the engine is crossed off and unable to launch the error it turns back is the following:

2022-02-16 19:56:55.079 Keyboard Maestro[5604:176830] KMApplication::LaunchEngine error Error Domain=NSCocoaErrorDomain Code=259 "The application “Keyboard Maestro Engine.app” could not be launched because it is corrupt." UserInfo={NSURL=file:///Applications/Keyboard%20Maestro.app/Contents/MacOS/Keyboard%20Maestro%20Engine.app/, NSLocalizedDescription=The application “Keyboard Maestro Engine.app” could not be launched because it is corrupt., NSUnderlyingError=0x60000105c0c0 {Error Domain=NSOSStatusErrorDomain Code=-10827 "kLSNoExecutableErr: The executable is missing" UserInfo={NSURL=file:///Applications/Keyboard%20Maestro.app/Contents/MacOS/Keyboard%20Maestro%20Engine.app/}}}

I have uninstalled and reinstalled KM twice first using the default Mac uninstall and the next using an app cleaner to verify all files were removed.

I am running an M1 Mac on Monterey 12.1

2

You did a lot of good things there.

  1. In your log it says both "is corrupt" and "is missing." I'm not sure which one to believe. Could you browse to that location to see if it's there?
  2. Have you ever had KM working on that Mac before?
  3. Have you tried running in Safe Mode? (Scratch that idea. It probably won't help.)
  4. Have you tried running Disk First Aid? (Other people have had similar errors and it was a HDD corruption problem.)

It almost sounds like maybe your installation app is corrupt. Try re-downloading from https://files.stairways.com

If these ideas don't work, I probably can't help. I'm just an average Joe here.

3

Thanks for all the ideas, I have had any form of KM on this Mac before. The file is not " missing" it exists within the contents of the km.app. It just won't seem to launch.

Screen Shot 2022-02-16 at 9.36.13 PM
Screen Shot 2022-02-16 at 9.36.13 PM854×314 52.8 KB

I tried downloading an older version of KM but it seems not matter which one I download my Engine is unable to launch. I'm going to try the disk first aid and see if that helps me out. However, it is odd that only the engine file seems to get corrupt.

4

I'm out of ideas, but I think you must try MacOS's Disk First Aid. A couple of indicators seem to suggest that this may be the problem/solution.

5

I have seen this caused by badly behaved security software. Specifically I know Sentinel (whatever its caused) thinks Keyboard Maestro Engine is a problem for whatever weird reason it has.

3 Likes
6

Wow thank you so much, I do have sentinel one and I didn't even think about that.

Edit: Added it to an exclusion and it worked.

4 Likes
7

I am having the same problem. SentinelOne has now quarantined the Keyboard Maestro Engine, so Keyboard Mastro is basically broken for me. I cannot add it to an exclusion list, since that's managed by my company. And since I don't expect this large, Windows dominated company to add Keyboard Maestro to the exclusion list, I wonder: is there anything else I or the developers can do to fix this?

Thanks!

8

Unfortunately no. I have no idea why SentinelOne’s database decides Keyboard Maestro Engine should be quarantined, and my attempts to communicate with them resulted in nothing. So I have no idea how or if the issue could be resolved on my end.

2 Likes
9

@peternlewis That's too bad. Still, thanks for the quick response.

1 Like
10

So it looks like version 10.0.2 works. I had the same issue.

11

I have solved this problem.

  1. Download KM version 9.2.
    Stairways Software: Download Links
  2. Install KM 9.2 and then set it.
  3. Click "Check for update..." in the Keyboard Maestro menu bar to update to v10.2.
  4. Everything's gonna be fine.
2 Likes
12

After a few days that thing quarantined it and now I am on v10.1.1.

14

I am an administrator for S1. In the portal you have to add an exclusion by the file location or hash. If you are not an administrator you will need to contact your IT dept that administers it.

1 Like
15

I am also at a large company. These instructions worked for me. Thanks, @lark !

2 Likes
17

I'm having this problem too. Also with KM version 11 that has just been released. It is quarantined by Sentinel One almost immediately.

Version 10.1.11 is the latest version I found that works and is not quarantined.

18

I've experienced this issue as well. My company added the KM Engine file via hash to the exclusion rule and that seemed to work well. (They may have also done it by location as well, but I'm not sure). Regardless, KM seems to work for a time; but, after awhile, S1 will (seemingly at random) add the file back to their quarantined set of files. It just happened for me this week actually. And, according to our IT team, the hash of the file being blocked matches what they have listed in their exclusion rule. It's got them scratching their heads in annoyance. Anyways...no answers here. Just thought I'd take a moment to say that the battle continues. I'm sure we'll likely end up needing to do a little dance of removing/adding the rule in S1, uninstalling/reinstalling KM, and restarting my machine to get it all working again. I'll try to remember to report back here afterward.