topic Re: Problems installing Cortex XDR to a user in Cortex XDR Discussions

Problems installing Cortex XDR to a user

irissentinel — Wed, 17 Nov 2021 13:22:05 GMT

Hello Palo Alto Team.

When installing Cortex XDR on a user, we must disable Windows Anti-Tampering, due to the following error:

If Windows Anti-Tampering is disabled, we still have installation problems.

Operating system name: Microsoft Windows 10 Pro

Operating system version: 10.0.19042 N/D Compilación 19042

Re: Problems installing Cortex XDR to a user

P.Jacob — Wed, 17 Nov 2021 13:44:08 GMT

I see that as well on a handful of assets as well. I spoke to the tac on this and they basically said to either un-install or run the cleaner.

you can also try to use cytool to disable

cytool protect disable process

cytool protect disable Registry

cytool protect disable file

cytool protect disable service

https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windows/troubleshoot-traps-for-windows/cytool.html

Having said that I always see this on a handful of assets, and find it is just quicker to either uninstall the old version then re-install.

would be nice to know why this is happening.

Re: Problems installing Cortex XDR to a user

irissentinel — Tue, 14 Dec 2021 11:31:03 GMT

Hello.

I have tried uninstalling and running the cleaner. Also with the cytool tool to disable.
this is the error that appears when reinstalling the new version.

Re: Problems installing Cortex XDR to a user

fmoixsante — Tue, 14 Dec 2021 12:04:49 GMT

Hi @irissentinel

As @P.Jacob mentioned, you first need to disable the Agent Tampering protections.

You need to open CMD in admin mode, cd to "c:\program files\Palo Alto Networks\Traps\", then type "cytool protect disable". You will need to enter the Supervisor/Uninstall password. All protections are disabled. Now you can continue with uninstall/install process.