topic Powershell script for XDR agent removal? in Cortex XDR Discussions

Powershell script for XDR agent removal?

CraigV123 — Fri, 18 Sep 2020 17:22:04 GMT

Would anyone happen to have an example of a powershell script that'll assist in removing the XDR agent? Thanks ahead of time.

Re: Powershell script for XDR agent removal?

PBurns — Wed, 07 Oct 2020 13:27:57 GMT

One option would be to request the XDR Cleaner Tool from support and use:

REM to disable agent protect and remove agent with XDRAgentcleaner
@echo off
echo Password123|"%ProgramFiles%\Palo Alto Networks\Traps\cytool.exe" protect disable
REM use xdrcleaner note the password is in clear txt
xdragentcleaner.exe --silient --password Password123 --log c:\remove.log

Re: Powershell script for XDR agent removal?

Antonetta — Thu, 19 Nov 2020 11:09:52 GMT

Most Anti virus has an anti tamper password. Call the vendor if it's not working. There's probably registry keys and possibly other system files to hook the kernel.

Bat script for XDR agent removal?

Daniel_RuizPadilla — Fri, 12 Feb 2021 19:27:51 GMT

Hi folks,

Could you help me plaease to know how can i create a bat script to execute Cortex Agent cleaner with anti tampering password to remove cortex agents?

I have to use bat because powershell is prohibited