In case you are prevented from unloading it, make sure anti-tampering is disabled: mdatp config tamper-protection enforcement-level --value disabled