Cortex XDR supervisor password

[Marsooq_A]

Hi Team,

Some cytool commands were asking to enter supervisor password to proceed, Is this the uninstall password had to set while creating the package? or the Login account password?

[dfalcon]

HI @Marsooq_A -

Yes, this is the uninstall password.  If you need to change the password, this can be done within the agent profile.

[Marsooq_A]

well , It didn't work for me, even I created a dedicated policy for an endpoint with customized agent profile with a known uninstall password to test this. But did not work

[Marsooq_A]

[dfalcon]

Hi @Marsooq_A-

When you go to to your list of endpoints, can you right-click on the machine in question then select Endpoint Data > View Endpoint Policy.

From there, can you please confirm that the machine received the correct profile?

[Marsooq_A]

@dfalcon , Yes the endpoint is configured with right policy.

[dfalcon · Accepted solution]

One more thing to confirm -- did you run cmd.exe as administrator?

[Marsooq_A]

@dfalcon 

Thanks for the suggestion, its working with cmd with admin privilege

[vigneshmohan]

Same issue even if i am working with cmd with admin privileges,

but got resolved once I set new uninstall password as specified above.

Thanks Dfalcon

[yogisun]

Hi @vigneshmohan ,

Could you share the steps to change uninstall password? did you perform that using Cytool or other tools?

Thanks

[yogisun]

Hi @dfalcon ,

I tried running the "Cytool protect disable" command in cmd - admin window. Still it requested for password, I gave the user password with which I was logged in to the system. It is part of admin group. But the 'protect disable' command gave 'Access denied' response.

Regards

[vigneshmohan]

Please access to Management Console >>> Go to your Cortex XDR instance where u have your endpoint XDR Agent is binded  >>> Go to Endpoint Tab >>> Policy Management>>> Profiles>>> Agent settings profile ( the Agent settings profile that you added to your policy that has your endpoint as its target) >>> Uninstall Password >>> Change the uninstall password to your own local password,

make sure to Check-in ( perform heart beat),

Now what you had done is replaced either the global settings/ Agent Settings uninstall password

hope it helps

[vigneshmohan]

Supervisor password is also called as Uninstall Password

to change it >> go and change the agent settings profile uninstall password. This must be done on your Cortex XDR Instance.

Steps

Please access to Management Console >>> Go to your Cortex XDR instance where u have your endpoint XDR Agent is binded >>> Go to Endpoint Tab >>> Policy Management>>> Profiles>>> Agent settings profile ( the Agent settings profile that you added to your policy that has your endpoint as its target) >>> Uninstall Password >>> Change the uninstall password to your own local password,

make sure to Check-in ( perform heart beat),

Now what you had done is replaced either the global settings/ Agent Settings uninstall password