topic Cortex XDR installed on personal computer which was used for work more than 5 years ago in Cortex XDR Discussions

Cortex XDR installed on personal computer which was used for work more than 5 years ago

Bernat — Sat, 31 Dec 2022 11:01:03 GMT

Hi,

Hi have this personal computer which I used for work several years ago (5). I started working for another company and stopped using this computer for work stuff.

Recently, about a year ago, I started using it again for all kind of things (streaming, tech stuff, gaming, etc.), and a new application has shown up which wasn't installed before (!), preventing me from doing certain things: Cortex XDR.

I suspect my computer wasn't removed from that Company's inventory, and I didn't take proper measures to remove any corporate configuration. I tried uninstalling it, but it's telling me there's some Anti-Tampering thing preventing me from uninstalling. I can tell the support staff which company it is, but it's been sold to another company few years ago.

How can I uninstall this new application Cortex XDR from my personal computer? Version is 7.3.1.

Thanks in advance!

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Cortex XDR installed on personal computer which was used for work more than 5 years ago

etugriceri — Tue, 03 Jan 2023 09:41:36 GMT

Hi @Bernat

You cannot un-install Cortex XDR, if your old company enabled Anti-tamper protection and if you dont know uninstall password.

You can try with Password1 . This is default password but we are highly recommending to change this password and most probably, Your old company is not using this password anymore. You can reach out them to learn password.

i saw your agent 7.3. this is unsupported version and not supporting token based one time uninstall password which means that you need general or policy based uninstall password.

You can open TAC ticket to get xdrcleaner.exe but since you dont have active support contract, maybe your old company open a ticket for you.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Uninstall-the-Cortex-XDR-Agent-for-Windows?section=UUID-1a571be7-5e84-ad88-372c-76f7fc579e07_id183HK0SK0O4

Re: Cortex XDR installed on personal computer which was used for work more than 5 years ago

Bernat — Fri, 06 Jan 2023 17:32:46 GMT

Hi @etugriceri and thanks for your response.

I tried with Password01 but it didn't work (thank godness for whoever installed it, but bad news for me). However, I've been able to get the hash and salt from the current installation.

I'll try opening a TAC ticket, can you provide a link for that? I wonder if I'm breaking any laws by having a licensed application by a 3rd company installed in a personal laptop 😅.

Hopefully, I can get full control of my PC without having to reinstall everything.

Best regards.

Re: Cortex XDR installed on personal computer which was used for work more than 5 years ago

Raido_Rattameister — Fri, 06 Jan 2023 21:14:59 GMT

It is possible to remove XDR without knowing uninstall password but you need to boot into Safe mode, clean up some registry entries and at the end run Traps removal tool (XDR was called Traps back in a day).

TAC will provide you steps and Traps removal tool (maybe it has been renamed by now...).