Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Issues with Mass Uninstallation of Cortex XDR Agents via SCCM

L0 Member

Cortex XDR sometimes have these stubborn machines that refuse to upgrade to the latest versions.

what are ways you use to alleviate this issue? Mine is SCCM.

I am trying to automate the mass uninstallation of older versions of Cortex XDR agents via SCCM on hundreds of Windows clients. The issue I’m encountering is related to password handling during the uninstallation process.


The process requires disabling runtime protection using cytool.exe, which prompts for a supervisor password. Despite my efforts to pass this password programmatically, the process fails, forcing me to input it manually across test machines. Additionally, I am encountering Errors when disabling protection with my own custom code derived from the original code support gave me, which further complicates the process.

I have referenced Cortex XDR documentation for uninstalling the agent for Windows using Msiexec, but it is not sufficient for handling this large-scale deployment. The document says something about " uninstalling XDR Agent using the MSI file via SCCM" but proceeds not to show how.

 

The code provided by customer support to resolve this has also not worked in practice.

Code Provided by Support that does not work:

ECHO OFF
ECHO Password1| "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" protect disable
"C:\temp\XdrAgentCleaner.exe" --silent --password Password1 --log C:\temp\XDRAgentUninstallScript.log

This script has not worked to bypass the manual password entry, and the XDR cleaner does not run seamlessly.

Request:

• Maybe i am doing this all wrong, i am open to any advice with proper documentation on handling a mass uninstallation of devices for those stubborn endpoints that cannot be upgraded via the cortex tool.

• I need guidance on automating this uninstallation without manual password input.
• If there is a method to bypass or handle the password input more effectively for cytool.exe, please provide details.
• Recommendations on fixing the incomplete XDR cleaner tool execution would also be very helpful.

1 REPLY 1

L5 Sessionator

Hello @V.Wokili ,

 

It would be great if you can reach out to TAC support to have a look. May be they can help you with some recommendation.

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

 

Regards,

Ashutosh

Ashutosh Patil
  • 315 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!