topic Re: Cortex XDR Uninstall without password and active tenant in Cortex XDR Discussions

Cortex XDR Uninstall without password and active tenant

LABRIC — Thu, 23 Sep 2021 15:50:39 GMT

On Windows computer we have installed the cortex XDR agent on POC tenant.

The tenant was deleted but we don't uninstalled the agent on the client computer.

We try to uninstall it manually, but we don' have the password.

We try with the default password, but we can't.

Any idea to uninstall ?

#Cortex #Cortex XDR #uninstall

Re: Cortex XDR Uninstall without password and active tenant

eluis — Fri, 24 Sep 2021 08:38:23 GMT

Hi Labric,

could you please try with the password:

Password1

and please tell us the outcome. You should be able to uninstall it with this one.

The usual way to uninstall customers should be better from management console. Locally on the agent for example when you lost communications with the management console or in you case that the tenant was deleted.

KR,

Luis

Re: Cortex XDR Uninstall without password and active tenant

LABRIC — Fri, 24 Sep 2021 08:27:29 GMT

Hi Luis,

We try this password but it doesn't work.

Laurent

Re: Cortex XDR Uninstall without password and active tenant

eluis — Fri, 24 Sep 2021 10:30:20 GMT

Hi Laurent,

Please open a support ticket with TAC. They will give you a tool for xdr agent cleaner and instruccions on how to proceed. Youll have to boot windows in safe mode and execute the cleaning app in such safe mode.

Please note that you will have to boot in safe mode manually every single computer that you need to uninstall.

The above is valid for windows OS

If your OS is linux or macOS. You dont need to boot on safe mode. In this case, your uninstall password is the root password for the OS

Please give us feedback on the results.

KR,

Luis

Re: Cortex XDR Uninstall without password and active tenant

yogisun — Sun, 03 Oct 2021 01:41:18 GMT

Hi @eluis ,

I am facing same issue as @LABRIC .

Could you please explain what "TAC" is? is it some sort of open in LIVE community or do we need to register separately?

If it is a separate registration, could you share the url for TAC where I can open a ticket..

It would be great if there is a public file share repository which can be used for download of "tool for xdr agent clean up".

regards

Re: Cortex XDR Uninstall without password and active tenant

eluis — Sun, 03 Oct 2021 09:03:48 GMT

Hi Yogisun,

TAC is the support for customer facing problems related to bugs on our products. You can open a ticket when you have a technical issue related to a bug or malfunction of Cortex XDR.

The url is as follows and yes, you should register there as a customer:

https://support.paloaltonetworks.com/

For the agent uninstall in lets say non-standard procedure, the supported way is to open a ticket. They will provide instructions on how to proceed and also the software needed.

I hope this helped you.

KR,

Luis

Re: Cortex XDR Uninstall without password and active tenant

fbisso — Fri, 13 Sep 2024 16:30:02 GMT

Hi Eluis, sorry for reopening this post.

We have the same problem. Out Tenant was deleted and we don't have the uninstall password.

We were able to uninstall Cortex on linux and Windows, but we couldn't on macOS.

We try using root password as uninstall password but that didn't work.

Can you help us?

We don't have an active support so we can't open a support ticket with TAC.

Cortex Version 8.4.

Thanks in advance.

Re: Cortex XDR Uninstall without password and active tenant

hirambrankefsky — Wed, 25 Mar 2026 07:50:21 GMT

I don't care how, I just want to uninstall your bloody damned software from my pc. I can't create a case. Tell me how do it, i have not password.

Re: Cortex XDR Uninstall without password and active tenant

kiwi — Wed, 25 Mar 2026 08:21:32 GMT

Hi @hirambrankefsky ,

Removing Cortex XDR from a personal machine without the uninstall password is difficult by design, as the software includes "Tamper Protection" to prevent unauthorized removal.

There are several thing you can try but if everything else fails it may come down to reaching out to your XDR tenant admin to have it removed via the Cortex XDR management console.

There are several discussions on the topic. Here are some examples:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/impossible-uninstall-cortex-xdr/m-p/1000...

https://live.paloaltonetworks.com/t5/general-topics/uninstalling-cortex-xdr/m-p/560129#M113566

Kind regards,

-Kim.