Can global uninstall password expire?

[Danmar]

We noticed that the global uninstall password set last year at the end of May no loger works, in the Management Audit Logs there are no other events "Agent global uninstall password updated".

Can it expire? or be changed without generating an event in the audit logs?

[jmazzeo]

Hi @Danmar, thanks for reaching us using the Live Community.

The Global Uninstall Password doesn't expire, and the audit action should be logged in the console aswell.

Something like that usually happens when you have an Agent Settings profile assigned to the endpoint with a different uninstall password configured that will override the global one. Here is more information about this: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Configure-global-agen...

To check this, go to the assigned Agent Settings profile on that endpoint, and check the Uninstall Password setting. If the "Default" check is disabled then a different password was created.

If this post answers your question, please mark it as the solution.

[Danmar]

Hi Jmazzeo, yes I checked all agent policies are on default. What if someone tries to brute force this password? After x tries does it locks out the local system or password for all users?

[jmazzeo]

No @Danmar, there is no lock out for brute forcing the password locally on an endpoint.