Orphaned Cortex XDR Agent enforcing USB read-only on personal laptop

ghilinta.anca — Thu, 02 Jul 2026 10:10:22 GMT

Hello,

I have a personal Windows 11 Pro laptop with Cortex XDR Agent 9.2.0 installed.

The agent is no longer connected to any management server and the GUI shows:

Connection: No connection to server

However, Device Control is still active.

Every time I connect my Samsung T7 Shield external SSD, I receive the notification:

"Cortex XDR | Device Control - USB device is in read-only mode."

The SSD is healthy (verified with Samsung Magician) and Windows DiskPart shows:

Current Read-only State: Yes
Read-only: No

I also confirmed that the notification comes directly from Cortex XDR.

Anti-Tampering is enabled.

cytool protect disable requires the Supervisor Password.

cytool protect query shows all protections enabled.

The agent has no connection to a management server and I do not know the Supervisor Password.

This is my personal laptop. It is not managed by any organization and I do not have access to any Cortex tenant.

Is there an official recovery procedure or cleanup utility for removing an orphaned Cortex XDR agent that still enforces Device Control?

The attached screenshot shows that the Cortex XDR agent has no connection to any management server, yet it continues to enforce Device Control policies and blocks USB storage devices by forcing them into read-only mode.

Thank you.

topic Orphaned Cortex XDR Agent enforcing USB read-only on personal laptop in Cortex XDR Discussions

Orphaned Cortex XDR Agent enforcing USB read-only on personal laptop