topic Re: Reconnect disconnected XDR Clients remotely an easy way in Cortex XDR Discussions

Reconnect disconnected XDR Clients remotely an easy way

Miroslaw_Iwanowski — Thu, 15 Apr 2021 08:29:13 GMT

Hello,

We had an issue of some computers getting disconnected status in XDR. In Lansweeper the status of XDR was disabled. After a long discussion with local support we came out with a nice procedure that allows to reconnect those client without reinstallation.

Assume we have a laptop lt00666 with a XDR client installed but disconnected from XDR console.

Open a command line to swclt00666 using Sysinternaltools tool psexec64

Psexec64.exe \\swclt00666 cmd

Move to XDR client dir

cd c:\Program Files\Palo Alto Networks\Traps

Get XDR client info

c:\Program Files\Palo Alto Networks\Traps>cytool.exe enum

Process ID Agent Version

1072 7.2.1.2718

Go to your XDR console and display Agent Installations

Make sure you have package ID enabled in default view

Copy ID for XDR version of the disconnected station - it will be long alphanumeric string (it is good to have it prepared for most common version you use so you do not have to look up at the console)

Issue a command to reconnect device to our XDR server (this is one line)

c:\Program Files\Palo Alto Networks\Traps>cytool reconnect force 1d7b234343434343444cc

There will be no prompt displayed and you have to enter (paste) uninstallation password. After you enter it and press enter the device will display:

Enter supervisor password:

c:\Program Files\Palo Alto Networks\Traps>

The laptop should already be visible in console. Upgrade to latest version and it is finished.

Procedure works very nice for us and I hope that it will save some time for the community also.

Re: Reconnect disconnected XDR Clients remotely an easy way

gjenkins — Tue, 20 Jul 2021 23:08:10 GMT

@Miroslaw_Iwanowski wrote:
Hello,
We had an issue of some computers getting disconnected status in XDR. In Lansweeper the status of XDR was disabled. After a long discussion with local support we came out with a nice procedure that allows to reconnect those client without reinstallation.

Assume we have a laptop lt00666 with a XDR client installed but disconnected from XDR console.

Open a command line to swclt00666 using Sysinternaltools tool psexec64
Psexec64.exe \\swclt00666 cmd

Move to XDR client dir
cd c:\Program Files\Palo Alto Networks\Traps

Get XDR client info

c:\Program Files\Palo Alto Networks\Traps>cytool.exe enum
Process ID Agent Version
1072 7.2.1.2718

Go to your XDR console and display Agent Installations

Make sure you have package ID enabled in default view

Copy ID for XDR version of the disconnected station - it will be long alphanumeric string (it is good to have it prepared for most common version you use so you do not have to look up at the console)

Issue a command to reconnect device to our XDR server (this is one line)
c:\Program Files\Palo Alto Networks\Traps>cytool reconnect force [omitted]

There will be no prompt displayed and you have to enter (paste) uninstallation password. After you enter it and press enter the device will display:

Enter supervisor password:

c:\Program Files\Palo Alto Networks\Traps>

The laptop should already be visible in console. Upgrade to latest version and it is finished.

Procedure works very nice for us and I hope that it will save some time for the community also.

Hi @Miroslaw_Iwanowski ,

Thank you for posting your clever reconnection solution using psexec!

If I were to make a recommendation, I would omit the trailing tenant ID mentioned after the "cytool reconnect force" command as it is sensitive information unique to your XDR tenant.

Re: Reconnect disconnected XDR Clients remotely an easy way

mjfarfan — Sat, 28 Oct 2023 01:52:53 GMT

hello. what is the supervisor password? I'm admin and my password doesn't work. thanks