Cortex XDR Uninstall without password and active tenant

[LABRIC]

On Windows computer we have installed the cortex XDR  agent on POC tenant.

The tenant was deleted but we don't uninstalled the agent on the client computer.

We try to uninstall it manually, but we don' have the password.

We try with the default password, but we can't.

Any idea to uninstall  ?

#Cortex #Cortex XDR #uninstall

[eluis]

Hi Labric, 

could you please try with the password: 

Password1 

and please tell us the outcome. You should be able to uninstall it with this one. 

The usual way to uninstall customers should be better from management console. Locally on the agent for example when you lost communications with the management console or in you case that the tenant was deleted. 

KR, 

Luis 

[LABRIC]

Hi Luis,

We try this password but it doesn't work.

KR 

Laurent

[eluis]

Hi Laurent, 

Please open a support ticket with TAC. They will give you a tool for xdr agent cleaner and instruccions on how to proceed. Youll have to boot windows in safe mode and execute the cleaning app in such safe mode. 

Please note that you will have to boot in safe mode manually every single computer that you need to uninstall. 

The above is valid for windows OS

If your OS is linux or macOS. You dont need to boot on safe mode. In this case, your uninstall password is the root password for the OS

Please give us feedback on the results.

KR,

Luis 

[yogisun]

Hi @eluis ,

I am facing same issue as @LABRIC .

Could you please explain what "TAC" is? is it some sort of open in LIVE community or do we need to register separately?

If it is a separate registration, could you share the url for TAC where I can open a ticket..

It would be great if there is a public file share repository which can be used for download of "tool for xdr agent clean up".

regards

[eluis]

Hi Yogisun, 

TAC is the support for customer facing problems related to bugs on our products. You can open a ticket when you have a technical issue related to a bug or malfunction of Cortex XDR. 

The url is as follows and yes, you should register there as a customer: 

https://support.paloaltonetworks.com/

For the agent uninstall in lets say non-standard procedure, the supported way is to open a ticket. They will provide instructions on how to proceed and also the software needed.

I hope this helped you. 

KR,

Luis 

[fbisso]

Hi Eluis, sorry for reopening this post.

We have the same problem. Out Tenant was deleted and we don't have the uninstall password.

We were able to uninstall Cortex on linux and Windows, but we couldn't on macOS.

We try using root password as uninstall password but that didn't work.

Can you help us?

We don't have an active support so we can't open a support ticket with TAC.

Cortex Version 8.4.

Thanks in advance.