topic Can global uninstall password expire? in Cortex XDR Discussions

Can global uninstall password expire?

Danmar — Wed, 20 Mar 2024 13:11:21 GMT

We noticed that the global uninstall password set last year at the end of May no loger works, in the Management Audit Logs there are no other events "Agent global uninstall password updated".

Can it expire? or be changed without generating an event in the audit logs?

Re: Can global uninstall password expire?

jmazzeo — Wed, 20 Mar 2024 13:53:10 GMT

Hi @Danmar, thanks for reaching us using the Live Community.

The Global Uninstall Password doesn't expire, and the audit action should be logged in the console aswell.

Something like that usually happens when you have an Agent Settings profile assigned to the endpoint with a different uninstall password configured that will override the global one. Here is more information about this: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Configure-global-agent-settings

To check this, go to the assigned Agent Settings profile on that endpoint, and check the Uninstall Password setting. If the "Default" check is disabled then a different password was created.

If this post answers your question, please mark it as the solution.

Re: Can global uninstall password expire?

Danmar — Thu, 21 Mar 2024 08:03:40 GMT

Hi Jmazzeo, yes I checked all agent policies are on default. What if someone tries to brute force this password? After x tries does it locks out the local system or password for all users?

Re: Can global uninstall password expire?

jmazzeo — Thu, 21 Mar 2024 12:27:19 GMT

No @Danmar, there is no lock out for brute forcing the password locally on an endpoint.