topic Re: How to Prevent local admin on an endpoint from pause/remove the cortex XDR agent? in Cortex XDR Discussions

How to Prevent local admin on an endpoint from pause/remove the cortex XDR agent?

m.assi — Fri, 26 Sep 2025 18:53:44 GMT

Hi there,
Excuse me, I see that there's an ability for the Admin users in their endpoint that can Bypass (Paus/Remove) the Cortex XDR agent. for both Windows and Linux OS.
How to prevent that through polices or something like that.
Also how to prevent them from Booting and doing formatting.

Thanks and Regards.

Re: How to Prevent local admin on an endpoint from pause/remove the cortex XDR agent?

eluis — Mon, 29 Sep 2025 12:49:19 GMT

Hi @m.assi

On the agent settings profiles you have to enable the anti-tampering functionality to prevent a user to manipulate/disable/remove the XDR agent.

You can find this options under the Agent Security area of the mentioned profiles.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thank you.

KR,

Luis