topic Re: How to Uninstall Cortex with disabling anti-tampering protection in General Topics

How to Uninstall Cortex with disabling anti-tampering protection

Zaffrul — Thu, 09 Feb 2023 13:18:53 GMT

Hi All,

Anyone can help how to uninstall Cortex XDR with disabling anti-tampering protection?I am trying to uninstall from SCCM and due to the anti-tampering protection, it require password to disable the protection first before i can proceed with the uninstallation. Perhaps any bat script on this that i can use it.

Regards,

Zaffrul

Re: How to Uninstall Cortex with disabling anti-tampering protection

kiwi — Thu, 09 Feb 2023 13:25:07 GMT

Hi @Zaffrul ,

Please check the following discussion on the same topic:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-uninstall-without-password-and-active-tenant/td-p/436179

Kind regards,

-Kiwi.

Re: How to Uninstall Cortex with disabling anti-tampering protection

Zaffrul — Thu, 09 Feb 2023 13:32:22 GMT

Hi Kiwi,

Thanks for the respond. The link given is not the same topic as mine. My issue is, i can't uninstall Cortex XDR from SCCM due to anti-tampering protection. It require to insert the supervisor password in order to proceed with uninstallation. I have the password but i don't know what is the correct parameter to insert in bat script for disabling the anti-tampering protection.

Regards,

Zaffrul

Re: How to Uninstall Cortex with disabling anti-tampering protection

kiwi — Thu, 09 Feb 2023 13:50:11 GMT

Hi @Zaffrul ,

Gotcha, you can use the cytool utility that comes with the agent. You should be able to find it under 'C:\Program Files\Palo Alto Networks\Traps\cytool.exe'.

Type the following command to disable Anti-tampering:
cytool protect disable

It will ask for the password

This allows you to stop services, uninstall or do whatever you need to do.

Source:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cytool-for-Windows

Kind regards,

-Kiwi.

Re: How to Uninstall Cortex with disabling anti-tampering protection

Mudhireddy — Thu, 09 Feb 2023 14:14:47 GMT

adding along those above points...Yeah, I tested using >cytool runtime stop to uninstall the xdr-agent at the endpoint for testing. Password/temp-token is mandatory