topic Agent Blocking Command Prompt/Powershell in Cortex XDR Discussions

Agent Blocking Command Prompt/Powershell

KiranBashyal — Sun, 16 Jan 2022 05:21:08 GMT

The agent has been blocking acess to the CMD , The licensing has been expired due to which the dashboard cannot be logined. I tired to uninstall agent using Cleaner but even the Agent Cleaner has been blocked. What sort of procedures i should follow to uninstall the Agent.

Re: Agent Blocking Command Prompt/Powershell

Cyber1985 — Sun, 16 Jan 2022 09:29:47 GMT

Hey! As far as I know, you could try windows safe mode?

Best regards

Rob

Re: Agent Blocking Command Prompt/Powershell

bbarmanroy — Mon, 17 Jan 2022 05:35:19 GMT

Hi @KiranBashyal Do you have access to Powershell? Try uninstalling with Powershell (with administrator privileges) instead of Command Prompt.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.html

Re: Agent Blocking Command Prompt/Powershell

KiranBashyal — Mon, 17 Jan 2022 07:45:24 GMT

Thank you for the response. No the CLI (CMD and Powershell) is also been blocked . This is the new case i have discovered.

Re: Agent Blocking Command Prompt/Powershell

eluis — Mon, 17 Jan 2022 11:33:14 GMT

Hi all,

if you cant disable anti-tampering with the link my colleague @bbarmanroy provided

(https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-4/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.html )

I guess that you neither can't open a live terminal from the console

You might need to reboot windows in secure mode and use the cleaner (this should work). If you cant manage to do it by yourself, I recommend to open a support case and our TAC engineers will help you on this uninstall.

KR,
Luis