topic Re: How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console in Cortex XDR Discussions

How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console

Alpalo — Wed, 26 Feb 2025 08:01:27 GMT

Hello team,

We need to know how to disable (temporarily) the security in Cortex XDR to be able to update the client from outside the Console.

The updates from the console are causing us blue screens and we want to test it using scripts when shutting down the computers (Shutdown policies).

Can you tell us how to do it?

Regards

Re: How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console

mavega — Wed, 26 Feb 2025 18:36:06 GMT

Hi,

Thanks for joining Live Community.

You can try cytool command to disable protection on an endpoint:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cytool-for-Windows

If this solves your inquiry pleas mark it As Solution.

Re: How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console

Mudhireddy — Wed, 26 Feb 2025 19:39:14 GMT

I recommend updating the XDR agent manually, not automatically.

However, you can update using agent-settings profiles with auto-update, offering multiple options before any security issues like vulnerabilities. Also, you can try using global configuration for agent upgrade settings.

Re: How to (temporarily) disable security in Cortex XDR to be able to update the client from outside the Console

Aristooo — Thu, 27 Feb 2025 07:50:23 GMT

Hi.
Open CMD with administrator privilege. Go this location - C:\Program Files\Palo Alto Networks\Traps
Run this command - cytool protect disable
Enter supervisor password