topic Laptop with CortexXDR installed from a bankrupt company in General Topics

Laptop with CortexXDR installed from a bankrupt company

ArtWhite — Wed, 20 Sep 2023 13:30:04 GMT

Hi,

I've got a laptop from a previous employer who is in final stages of bankruptcy. I'm blocked from internet access once I was layed off based on policies in Cortex, I was curious at some point once the company is completely dissolved would the policies no longer be enforced. The reason I ask is when I go into the Cortex console it shows that it's connected to a particular url which mentions my previous company, wasn't sure if they pay for support of these policies.

Re: Laptop with CortexXDR installed from a bankrupt company

kiwi — Mon, 25 Sep 2023 08:53:23 GMT

Hi @ArtWhite ,

Cortex XDR licenses are valid for the period of time associated with the license purchase. After the Cortex XDR license expires, Cortex XDR allows access to your tenant for an additional grace period of 48 hours. After the 48-hour grace period, Cortex XDR disables access to the Cortex XDR app until you renew the license.

For the first 30 days of your expired license, Cortex XDR continues to protect your endpoints and/or network and retains data in the Data Layer according to your data retention policy and licensing. After 30 days, the tenant is decommissioned and agent prevention capabilities cease.

More info on XDR license:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Cortex-XDR-Pro-License

Alternatively you could also uninstall the agent:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide/Uninstall-the-Cortex-XDR-Agent-for-Windows

Kind regards,

-Kim.

Re: Laptop with CortexXDR installed from a bankrupt company

BPry — Mon, 25 Sep 2023 13:44:12 GMT

@ArtWhite,

If uninstall protection is enabled this doesn't turn off with the decommissioning of a tenant from my experience, it just becomes locked to whatever setting was present and the agent actually continues to be updated even though there's no tenant on the backend.

Assuming that you have access to the machine, I'd just reimage the thing at this point and be done with it. Unlikely that your past company will/can issue an uninstall to the endpoint. I'd also be really careful about using an endpoint that isn't cleared to be utilized, or wiping a machine owned by a company without explicit permission. If the company is going through bankruptcy IT assets will likely be sold off and liquidated as part of the proceedings.