topic Re: Uninstall agent rom MacOS in Cortex XDR Discussions

Uninstall agent rom MacOS

iscott — Thu, 11 Feb 2021 15:02:36 GMT

Hello,

We want to uninstall an agent from MacOS, but we do not have the admin password. And we can't reset the password because the tenant was deleted it. So the agent does not have administration from web console.

I try with "Passowrd1", it doesn't work.

Does someone know how to uninstall it? I know that for Windows, there is a "special cleaner" to delete the agent. But for MacOS, I don't know.

Regards,

Re: Uninstall agent rom MacOS

gjenkins — Sat, 13 Feb 2021 00:48:45 GMT

Hi @iscott,

Unfortunately, given that you don't have the admin or uninstall passwords or a valid connection to the XDR tenant from the endpoint to initiate the uninstall from there, the best next step would be a factory reset or a reimaging of the endpoint. Unlike Windows, the MacOS Cortex XDR Agent does not have a cleaner. It does have an uninstaller builtin, but you would need the uninstall password for that, so I could only offer a factory reset in this case.

Re: Uninstall agent rom MacOS

iscott — Fri, 07 May 2021 23:04:56 GMT

Hello, @gjenkins

Thanks for your answer. I know that has been past some months. What you said is correct. There is no cleaner for macOS. But, if you open a case, the TAC engineers will help with a script.

It is important to underline, for the community, that these delete tools are not public. In order to don't allow final users to uninstall the agent, without the right company permissions.

Please, do not share these Cortex XDR delete tools and scripts on public websites.