topic Re: Uninstalling Cortex XDR in General Topics

Uninstalling Cortex XDR

chaosza1543 — Sun, 01 Oct 2023 13:16:32 GMT

Hi All

I recently installed Microsoft teams at home to connect to work based meetings. It installed two additional software packages namely a vpn network as well as cortex xdr. I wish to uninstall cortex xdr as it is on my home computer however i do not have access to the password as tamper protection stops me from uninstalling.

Can anyone please assist me in what to do.

Re: Uninstalling Cortex XDR

kiwi — Mon, 02 Oct 2023 07:31:52 GMT

Hi @chaosza1543 ,

Did you try disabling the anti-tampering with the cytool command ? "cytool protect disable" "

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cytool-for-Windows

You can try with the default password : Password1

If that doesn't work then you'll need to contact your XDR tenant admin to have it removed as they should know the password or you can contact support.

Re: Uninstalling Cortex XDR

BPry — Mon, 02 Oct 2023 14:30:55 GMT

@chaosza1543,

Your administrator(s) likely enforces enrollment of the device and is forcing every enrolled device to get the VPN, maybe Teams, and have the Cortex XDR agent installed to access company resources on a BYOD endpoint. This isn't really an abnormal configuration or requirement across many different companies.

As @kiwi mentioned you can try the default password, just be aware that if your company is enforcing these things to access company resources you may break your access or otherwise be violating company policy. Chances are, if you ask about this you'll be forced to remove all company resources from the machine to remove Cortex XDR.

It's also possible that your admins aren't expecting anyone to enroll the device and they don't have policies scoped properly to prevent the installation of required applications. I wouldn't be shocked to see a smaller company encounter these sort of issues if they won't expecting anyone to use Teams on a personal device or enroll a non-work endpoint.

Re: Uninstalling Cortex XDR

MosR — Thu, 29 Aug 2024 17:01:36 GMT

You can ask you admin to remotely uninstall it or generate a temp admin token for you so that you can remove the agent.