Agent Blocking Command Prompt/Powershell

[KiranBashyal]

The agent has been blocking acess to the CMD , The licensing has been expired due to which the dashboard cannot be logined. I tired to uninstall agent using Cleaner but even the Agent Cleaner has been blocked. What sort of procedures i should follow to uninstall the Agent. 

[Cyber1985]

Hey! As far as I know, you could try windows safe mode? 

Best regards 

Rob

[bbarmanroy]

Hi @KiranBashyal Do you have access to Powershell? Try uninstalling with Powershell (with administrator privileges) instead of Command Prompt.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[KiranBashyal]

Thank you for the response. No the CLI (CMD and Powershell) is also been blocked . This is the new case i have discovered.

[eluis]

Hi all, 

if you cant disable anti-tampering with the link my colleague @bbarmanroy provided

(https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-4/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

I guess that you neither can't open a live terminal from the console

You might need to reboot windows in secure mode and use the cleaner (this should work). If you cant manage to do it by yourself, I recommend to open a support case and our TAC engineers will help you on this uninstall.

KR,
Luis