BAT Script to uninstall Cortex using Agent cleaner with disabling tampering protection

[Daniel_RuizPadilla]

Hi folks,

Could you help me plaease to know how can i create a bat script to execute Cortex Agent cleaner with anti tampering password to remove cortex agents?

I have to use bat because powershell is prohibited

[gjenkins]

Hi @Daniel_RuizPadilla,

Here's what I've been able to dig up from Support cases:

@echo off
echo Password123|"%ProgramFiles%\Palo Alto Networks\Traps\cytool.exe" protect disable
xdragentcleaner.exe --silent --password Password123 --log c:\remove.log
shutdown.exe /r /t 00

Note 1: On Windows 10, I had to suppress change notifications to "never notify" here: Security and Maintenance > Change User Account Control Settings > Reduce to "Never notify."

Note 2: I had to put the bat file in the folder with all of the decompressed XDR agent cleaner files.

I would suggest trying it on a few machines before attempting large numbers of endpoints.