topic Re: Impossible uninstall Cortex XDR in Cortex XDR Discussions

Impossible uninstall Cortex XDR

Rixals — Sun, 05 Jan 2025 17:35:02 GMT

Hello,

Because of my previous work, I had to install Cortex XDR to work remotely from home and access to the VPN.

Now that I'm no longer working for them, I would like to uninstall Cortex XDR from my laptop (MacBook Pro M2) but it is impossible. I tried to install the uninstaller but it impossible, the installation don't ever finish.

Someone know howt to delete Cortex XDR ?

Kind regards.

Re: Impossible uninstall Cortex XDR

kiwi — Thu, 09 Jan 2025 16:17:32 GMT

Hi @Rixals ,

To uninstall the agent, you need the uninstall password or a temporary token:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.2/Cortex-XDR-Agent-Administrator-Guide/Uninstall-the-Cortex-XDR-Agent-for-Mac

Hope this helps,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Thu, 09 Jan 2025 17:47:26 GMT

Hello @kiwi !

Thank you for your help !

Yes I saw that but I don't understand what I must do. I don't know where the "Cortex XDR management console" is and I don't get what an endpoint is, could you help me please ?

Have a nice day 😊

Re: Impossible uninstall Cortex XDR

kiwi — Fri, 10 Jan 2025 08:46:43 GMT

Hi @Rixals ,

You don't need to worry about the management console. That's likely managed by your previous employer.

You should uninstall it directly from your endpoint (= your MacBook).

Check the following process from the admin guide:

To uninstall the agent, you need the uninstall password or a temporary token. See Manage Agent Tokens to obtain a temporary token.

Ensure that you extract the uninstaller from the installer package which is the same version as the Cortex XDR agent for Mac currently installed on the endpoint.

Ensure that the installer file, called Cortex XDR Uninstaller.app, is saved in the following location: /Library/Application\Support/PaloAltoNetworks/Traps/bin

Run the Cortex XDR agent uninstaller Cortex XDR Uninstaller.app from: /Library/Application\Support/PaloAltoNetworks/Traps/bin.
When prompted, enter the Cortex XDR agent uninstall password or temporary token, and click OK.
When prompted, enter the macOS credentials for a user that has permissions to uninstall apps and click OK.

The uninstaller completes the uninstall process and removes the Cortex XDR agent and related files.

Good luck !

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Fri, 10 Jan 2025 11:09:37 GMT

Hello @kiwi !

Yes I tried to follow these instructions but I don't see where to execute the differents steps needed.

"1. View agent password.

You can view the password of the selected agent. Whether the password is from a rolling token or a temporary token is indicated in the dialog.

Select Endpoints → All Endpoints → Endpoint Control → View Token."

For exemple here where do I do "Select Endpoints → All Endpoints → Endpoint Control → View Token" ? The only thing related to Cortex XDR which I can interact with is this :

Have a nice day 😊

Re: Impossible uninstall Cortex XDR

kiwi — Fri, 10 Jan 2025 12:14:10 GMT

Hi @Rixals ,

The 'Manage Agent Token' is also part of the management console so you won't have access to that:

https://www.youtube.com/watch?v=G55kf6L0nas

Try using the default password and cross your fingers that it wasn't changed: Password1

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/need-to-change-the-uninstallation-password/td-p/532168

If the uninstall password was changed, then I'm afraid you'll need to reach out to your previous employer to assist you with uninstalling. The ones managing the management console should be able to provide you with the uninstall pwd or token.

Kind regards,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Fri, 10 Jan 2025 12:18:03 GMT

Hi @kiwi,

Okay I understand !

Now comes my main problem, where do I put this password ? I would presume in the uninstaller but I can't find it on my MacBook. Is it hidden ? Or maybe I can download it on internet ?

Kind regards,

Nathan

Re: Impossible uninstall Cortex XDR

kiwi — Fri, 10 Jan 2025 14:35:01 GMT

Hi @Rixals ,

Below is the path:

admin@lab bin % pwd /Library/Application Support/PaloAltoNetworks/Traps/bin admin@lab bin % ls Cortex XDR Agent.app dbtool Cortex XDR Configuration Wizard.app irpc_client_api Cortex XDR Uninstaller.app openssl authorized pmd cortex_xdr_uninstaller_tool sandboxd cytool traps_config

You can try uninstalling using the default password with the following command:

/Library/Application\ Support/PaloAltoNetworks/Traps/bin/cortex_xdr_uninstaller_tool Password1

Note however that tampering protection might be in place which might have to be disabled first using cytool (located in the same folder) . Use the same default password if it prompts you:

cytool protect disable

Kind regards,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Fri, 10 Jan 2025 16:23:39 GMT

Oh thank you I finaly found the Uninstaller !

But unfortunately it asks for a password and "Password1" doesn't work. Is there another way to pass around it ?

Re: Impossible uninstall Cortex XDR

kiwi — Mon, 13 Jan 2025 08:48:09 GMT

Hi @Rixals ,

Here's a similar discussion on the topic. Preferably try uninstalling using the management console (=via your previous employer).

Or you could try the Mac-OS root password:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-uninstall-without-password-and-active-tenant/m-p/436179#M1077

Once you exhausted all your possible passwords and still fail to uninstall the agent, try using the tool (reset_agent_settings) to help reset the agent settings. This should revert the uninstall password back to Password1.

You need to follow these steps to use the tool and reset the agent. Afterwards you should be able to uninstall using the default password:

A. Boot into macOS recovery OS (https://support.apple.com/en-us/102603)
B. If the disk is encrypted (FileVault enabled) unlock the disk (https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac)
C. Execute the tool (reset_agent_settings):

Run as root:

chmod +x /Volumes/<volume_name>/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings /Volumes/<volume_name>/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings

D. After the agent settings have been successfully reset, boot the macOS back to normal mode and uninstall the agent using the previously mentioned command using the default password: Password1

Good luck !

Kind regards,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Mon, 13 Jan 2025 17:49:29 GMT

Hello @kiwi,

Where do you find the tool "reset_agent_settings" ? When I search for it with the search bar I find the file but when I go the folder "download" there is nothing :

I tried to show hidden files but it didn't change anything.

Another question how do you run the tool "reset_agent_settings" ? Should I copy/paste the code lines you wrote under "Run as root" in the terminal and that's it ?

Kind regards,

Rixals

Re: Impossible uninstall Cortex XDR

kiwi — Tue, 14 Jan 2025 09:31:34 GMT

Hi @Rixals ,

The tool is located at /Library/Application\ Support/PaloAltoNetworks/Traps/download/content/

Only root user can run the tool.
The tool should not be moved/renamed, it needs to execute from its original location (it can be called with relative path and absolute path, both work).

The tool only runs in recovery OS mode (https://support.apple.com/en-us/102603)

If the disk is encrypted (FileVault enabled) unlock the disk (https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac)

Start Terminal and run the commands as a root user.

I'm not 100% sure but I believe starting in recovery mode already puts you at root privileges. So 'su' or 'sudo' won't be necessary and you should just run the command as is. If that's not the case then just 'sudo' the commands.

Kind regards,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Tue, 14 Jan 2025 20:36:29 GMT

Hello @kiwi,

Okay thank you !

I tried to enter the command you wrote in safe mode without FileVault and the terminal respond that :

/Volumes/Macintosh_HD/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings chmod: /Volumes/Macintosh_HD/Library/Application Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings: No such file or directory zsh: no such file or directory: /Volumes/Macintosh_HD/Library/Application Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings

I didn't change the volume name, is "Macintosh_HD" the right name ?

Re: Impossible uninstall Cortex XDR

reaper — Wed, 15 Jan 2025 08:53:10 GMT

have you tried reaching out to your previous employer's IT department to simply run the uninstall from the management console? (or release your agent)

Re: Impossible uninstall Cortex XDR

Rixals — Wed, 15 Jan 2025 08:58:17 GMT

Hello @reaper,

Yes I tried, it is a small reasearch institute and the person who told me to install Cortex XDR isn’t from IT or anything, she’s just the person who follow the instructions.

I tried to reach the IT department whose giving these instructions but to no avail.

Have a nice day !

Rixals

Re: Impossible uninstall Cortex XDR

kiwi — Wed, 15 Jan 2025 11:13:16 GMT

Hi @Rixals ,

It's probably not "Macintosh_HD" but rather "Macintosh HD" (with a space).

If the name was changed to something else then I don't know what it is and you can check it via Finder (Open Finder then use the menu Go > Computer).

Eitherway if it contains a space then you'll need to use a backslash to prevent the shell command from interpreting that space.

Notice how the same happens for "Application Support". In the command it's written as "Application\ Support" with a backslash to prevent the space from being interpreted by the shell command (it's a shell script thing).

/Volumes/Macintosh\ HD/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings

Hope this helps,

Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Wed, 15 Jan 2025 17:27:14 GMT

Hello @kiwi,

Thank you, I learned something thank you !

So I ran my MacBook in Safe Mode, without File Vault, and ran this command :

chmod +x /Volumes/Macintosh\ HD/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings /Volumes/Macintosh\ HD/Library/Application\ Support/PaloAltoNetworks/Traps/download/content/reset_agent_settings

And it said "This tool should run as sudo" whereas I tried with "sudo" and "su" in front of the command, I don't understand :

Re: Impossible uninstall Cortex XDR

kiwi — Thu, 16 Jan 2025 08:08:14 GMT

Hi @Rixals ,

If you want to run a command with root privileges you can prefix that command with 'sudo'. Then it will ask you for the password to the account you are logged in with (not the root account). Assuming that account is an administrator, of course.

Hope this helps,

-Kim.

Re: Impossible uninstall Cortex XDR

Rixals — Thu, 16 Jan 2025 08:44:25 GMT

Hello @kiwi,

Yes that’s what I did but it didn’t work unfortunately, you can see it in the screenshot that I put in my previous screenshot.

Did I wrote it wrong ?

Kind regards,

Rixals

Re: Impossible uninstall Cortex XDR

kiwi — Thu, 16 Jan 2025 09:42:15 GMT

Hi @Rixals ,

Yes, these are 2 separate commands.

The chmod +x command adds the execute (x) permission to the file. By doing that, you will allow the file to be executed as a program.

After that is the 2nd command where you will actually execute the file.

Try using sudo on both commands.

Hope this helps,

-Kim.