How to Remove a VPN Configuration on a Mac and What Remains

Removing a VPN on macOS looks like one action and is really at least four. The button in System Settings deletes a network service from the system configuration store. It does not delete the client app, the network extension that app installed, the credential sitting in your keychain, or a profile pushed by device management. Knowing which object owns each symptom is what stops a removed VPN from quietly coming back.

What the Remove Configuration button actually deletes

Every VPN you add becomes a network service, the same kind of object as Wi-Fi or Thunderbolt Bridge. macOS keeps all of them in /Library/Preferences/SystemConfiguration/preferences.plist, each with a service ID, a display name, and a configuration dictionary that describes the tunnel type, the server address, and how the tunnel starts.

When you open System Settings, VPN, click the information button beside a service, choose Remove Configuration and confirm, macOS stops the tunnel, deletes that service object, and rewrites the store. The teardown is complete for what the system owns: the service is gone from the list and nothing starts it at login.

What the button cannot reach is everything owned by another subsystem. The app bundle lives in /Applications. A NetworkExtension client runs as a system extension registered separately from its configuration. Credentials are keychain items with the access controls of whichever keychain holds them. A configuration profile is owned by the profile system. Remove the service and all four stay exactly where they were.

List what the Mac still thinks is installed

Take inventory before you delete anything. Three commands cover the three layers that produce the same visible failure:

scutil --nc list
networksetup -listallnetworkservices
profiles -P

scutil --nc list is the authoritative view of VPN configurations, with connection status, service name and service ID. It often shows entries that never appear in the Settings list: leftover services from a client you uninstalled months ago, and on-demand configurations that start silently. networksetup -listallnetworkservices shows the network services by the names the command-line tools expect, which is what you need for removal by name. profiles -P lists installed configuration profiles; on a managed Mac the VPN may not be a service you added at all, but a payload inside one of those profiles.

Read the lists together instead of trusting the first one. A service in scutil but not in Settings usually means a third-party client owns the tunnel and presents it in its own window. A service in both views that is greyed out in Settings means policy. A name that reappears after deletion means something re-creates it, and that something is the real target.

Remove the service through its owner

For a service you added yourself, stay on the documented path: System Settings, VPN, the information button, Remove Configuration. Apple documents that flow, and it keeps the configuration store consistent. Hand-editing preferences.plist while the network stack is running is how you end up with duplicate or zombie services that no interface will remove.

From a terminal, remove the service by name with networksetup -removenetworkservice "Service Name", then confirm with scutil --nc list. The command acts on the same service list as the interface, so a name that does not appear in networksetup -listallnetworkservices will not be removed by either path. When a client owns the tunnel, use that client's removal or uninstall path first, because the client rebuilds the service the next time it launches.

If the VPN came from device management, you are not the owner. Profiles installed by MDM can be marked non-removable, and even a removable one may be pushed again at the next check-in. Confirm with profiles -P, then use your organization's offboarding process. Deleting the payload locally either fails or triggers a reinstall.

The leftovers that reconnect without a service

The usual "it came back" report is not the service returning but the extension that owns it. List registered system extensions and network extension app extensions:

systemextensionsctl list
pluginkit -m -p com.apple.networkextension.packet-tunnel

A NetworkExtension client keeps its tunnel provider installed under its own identifier, separate from any configuration. The extension can remain active after the configuration is gone, and the client's menu bar agent can create a fresh configuration next time it starts, sometimes reusing the name you just deleted. Check login items and the vendor's helper in /Library/LaunchDaemons before concluding the removal failed.

Credentials are the second leftover. A saved password or client certificate in the login keychain is not deleted with the service, and an IPSec shared secret historically lives in the System keychain, which is why remove-and-re-add sometimes skips the password prompt. If the Mac is leaving your control, locate the item by service name in Keychain Access and revoke the account, certificate or peer key that the saved credential represents. A copied configuration file is a live credential even after local removal.

Verify removal, and read a returning profile correctly

Removal is finished when the service is gone from both views and stays gone after a restart. Check scutil --nc list for the service ID, confirm name resolution uses the resolver you expect with scutil --dns, then reboot once, because on-demand rules and login agents are the two things that only show themselves on a fresh boot.

If it is still there, do not delete more objects. Work out which layer re-created it: an MDM profile re-pushes the service, a client agent rebuilds it, or the service was never removed because the name did not match. That answer decides whether you need the vendor's uninstaller, your IT team, or another pass through the same remove dialog. Apple's removal guide covers the supported path for services you added; the leftovers are the part you have to check yourself: remove a VPN configuration.