topic Re: Suspecting XDR Agent Blocking Sysprep Process Randomly in Cortex XDR Discussions

Suspecting XDR Agent Blocking Sysprep Process Randomly

kpatel35ntt — Fri, 01 Aug 2025 07:28:56 GMT

We have noticed random block of sysprep process and ending up corrupting image. Has anyone noticed this?

Re: Suspecting XDR Agent Blocking Sysprep Process Randomly

eluis — Fri, 01 Aug 2025 15:13:59 GMT

Hi Kpatel35ntt,

It seems to me that this random block of sysprep has to do with our detection thinking that a legit process is maybe used in a suspicious way.

I see this have to be investigated further, so I would recommed to open a TAC support case, to figure out the root cause of false positives on sysprep behavior

A temporal solution would be to create a legacy exception on that process/path/hash... the more you narrow down, the better

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: Suspecting XDR Agent Blocking Sysprep Process Randomly

micomi — Mon, 04 Aug 2025 05:20:35 GMT

Check this knowledge base article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000blZlKAI

Could be the issue you have.

Hope this helps

Re: Suspecting XDR Agent Blocking Sysprep Process Randomly

kpatel35ntt — Mon, 04 Aug 2025 06:01:58 GMT

Palo TAC Support Feedback was to go with File Protection disable under Agent Security Settings. Test with updated version would help to remove unnecessary profiles.