Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

V.Wokili — Wed, 18 Sep 2024 16:15:56 GMT

Cortex XDR sometimes have these stubborn machines that refuse to upgrade to the latest versions.

what are ways you use to alleviate this issue? Mine is SCCM.

I am trying to automate the mass uninstallation of older versions of Cortex XDR agents via SCCM on hundreds of Windows clients. The issue I’m encountering is related to password handling during the uninstallation process.

The process requires disabling runtime protection using cytool.exe, which prompts for a supervisor password. Despite my efforts to pass this password programmatically, the process fails, forcing me to input it manually across test machines. Additionally, I am encountering Errors when disabling protection with my own custom code derived from the original code support gave me, which further complicates the process.

I have referenced Cortex XDR documentation for uninstalling the agent for Windows using Msiexec, but it is not sufficient for handling this large-scale deployment. The document says something about " uninstalling XDR Agent using the MSI file via SCCM" but proceeds not to show how.

The code provided by customer support to resolve this has also not worked in practice.

Code Provided by Support that does not work:

ECHO OFF
ECHO Password1| "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" protect disable
"C:\temp\XdrAgentCleaner.exe" --silent --password Password1 --log C:\temp\XDRAgentUninstallScript.log

This script has not worked to bypass the manual password entry, and the XDR cleaner does not run seamlessly.

Request:

• Maybe i am doing this all wrong, i am open to any advice with proper documentation on handling a mass uninstallation of devices for those stubborn endpoints that cannot be upgraded via the cortex tool.

• I need guidance on automating this uninstallation without manual password input.
• If there is a method to bypass or handle the password input more effectively for cytool.exe, please provide details.
• Recommendations on fixing the incomplete XDR cleaner tool execution would also be very helpful.

Re: Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

aspatil — Mon, 23 Sep 2024 09:26:25 GMT

Hello @V.Wokili ,

It would be great if you can reach out to TAC support to have a look. May be they can help you with some recommendation.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Regards,

Ashutosh

Re: Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

Sundi712 — Fri, 28 Feb 2025 18:47:50 GMT

Was there ever a solution that PaloAlto support can share here? I am having the same problem. Every time CortexXDR is updated I need to create a new SCCM package and have never been able to find a solution for this.

topic Re: Issues with Mass Uninstallation of Cortex XDR Agents via SCCM in Cortex XDR Discussions

Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

Re: Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

Re: Issues with Mass Uninstallation of Cortex XDR Agents via SCCM