topic Re: Remove Broker vm from CLI? in Cortex XDR Discussions

Remove Broker vm from CLI?

SeanDeHarris — Wed, 29 Apr 2026 04:42:17 GMT

hello experts,

my bvm has attacked to an old tenant, however, the old one has expired, is it possible to remove this from CLI through ssh to bvm?

Thanks,

Sdg

Re: Remove Broker vm from CLI?

mshamamulla — Wed, 29 Apr 2026 05:20:32 GMT

Hi @SeanDeHarris

Just try to unregister using the below command and let me know:

#sudo /opt/traps/bin/cytool unregister

LIVEcommunity Team Member
Empowering Security, Every Step
Mohammed Shamamulla

✔ Like posts that help you !!
✔ Accept as Solution to guide others !!

Read more about how and why to accept solutions.

Re: Remove Broker vm from CLI?

SeanDeHarris — Wed, 29 Apr 2026 06:56:21 GMT

thanks for your prompt reply,
when running cytool and prompt for admin password,

tried with the brokervm login password but failed.

any ideas what is this password?

Re: Remove Broker vm from CLI?

SeanDeHarris — Wed, 29 Apr 2026 07:17:05 GMT

I bet the admin pwd is not disclosed ?
Also, tried to run cytool from " /home/admin/sbin/cytool", it showed XDR Agent not installed.

Re: Remove Broker vm from CLI?

mshamamulla — Wed, 29 Apr 2026 07:58:28 GMT

This error message may be misleading please try below steps:-

1) There should be automatic unregister of BVM to understand the cause please check below
Login to the Broker VM via SSH or the local console and check the synchronization logs to see why the automatic timeout has not occurred. Run the following command:
tail -n 100 /data/logs/cloud_sync.log

Look for entries mentioning "HTTPUnauthorizedError" (401) or other status codes like 503. If you see 503 errors, your network security devices may be blocking the "Unauthorized" response required for the VM to unregister itself.

2) Manual unregistration (v28+ ONLY) :- Please try running the following command:
sudo /opt/panw/zenith/bin/cytool unregister

NOTE: If you are prompted for a sudo password and the admin password does not work, please try the default console password: !nitialPassw0rd

3) Reset Web UI:-
If the Web UI remains unresponsive, you can attempt to reset the administrative password via the CLI:
sudo /home/admin/sbin/setuipassword.sh

Follow the prompts to set a new password, then attempt to access the UI at:
https://[BROKERVMIP]:4443

4) FINAL RESOLUTION: REDEPLOYMENT
If the commands above are unavailable (likely due to an older software version) or fail to clear the registration, the only definitive solution for a Broker VM tied to a decommissioned tenant is a fresh redeployment:
Delete the current Broker VM instance from your hypervisor.
Download a new Broker VM image (OVA/ISO) from your NEW Cortex XDR tenant.
Deploy the new instance and apply a freshly generated registration token.

Re: Remove Broker vm from CLI?

SeanDeHarris — Wed, 29 Apr 2026 09:50:29 GMT

Thanks for your reply.

1. My BVM can connect to internet successfully, so there is no error of 401, 503, My BVM been registered to a tenant just happened to be expired and we did not unregister beforehand.

2. Both not working, nor my password and the default password: !nitialPassw0rd. The only password that I have configured is the password to login to WebUI, I bet it's not the admin of the OS,

3. The web ui is working perfectly fine with my password, however, the sudo /home/admin/sbin/setuipassword.sh mentioned here, required admin password which I do not have.

4. I guess this is the last and only resort, when the tenant is expired, previous registered BVM, no other way to unregister manually.

Re: Remove Broker vm from CLI?

mshamamulla — Wed, 29 Apr 2026 14:01:47 GMT

If none of the steps work then only Step-4 is left