MacOS uninstall password reset

[ThisizAmen]

Greetings!

I have a problem about Cortex XDR uninstall password in MacOS. The agent got corrupted while upgrading and from then on it is not upgrading to a new version thats why i was trying to uninstall cortex agent then reinstall new one.

sudo "/Library/Application Support/PaloAltoNetworks/Traps/bin/cortexxdruninstaller_tool"

I used this command and for the uninstall password i tried Password1 as this is the default one but didn't work (Get the error this password is not correct) then i updated uninstall password within the agent configuration and global agent configuration but after all i was unable to delete it.

Cortex XDR 

[susekar]

Hello @ThisizAmen ,

Greetings for the day.

When a Cortex XDR agent becomes corrupted during an upgrade, it often loses communication with the management console. Because of this, any password changes you make in the console will not sync to the endpoint, and the agent will continue to require the password it last received or revert to the default. Additionally, if the installation folder is damaged, the uninstaller itself may fail to validate credentials correctly.

We recommend we try the following steps to reset the local configuration and attempt a removal with a default password.

Method 1: Resetting Local Databases via Terminal
This method attempts to clear the local settings so the agent reverts to a default state.

1. Open the Terminal application on the Mac.
2. Unload the agent daemon by running the following command:
   sudo launchctl unload /Library/LaunchDaemons/com.paloaltonetworks.trapsd.plist
3. Remove the local database files that store the configuration and password hashes:
   sudo rm /Library/Application\ Support/PaloAltoNetworks/Traps/db/agentsettings.db
sudo rm /Library/Application\ Support/PaloAltoNetworks/Traps/db/cloudfrontend.db
4. Reload the agent daemon:
   sudo launchctl load /Library/LaunchDaemons/com.paloaltonetworks.trapsd.plist
5. Attempt to run the uninstaller tool again. When it asks for a password, try using the default: Password1
   sudo /Library/Application\ Support/PaloAltoNetworks/Traps/bin/cortexxdruninstaller_tool Password1

Method 2: Manual Removal via Recovery Mode
If Method 1 fails (often due to Tamper Protection), we must bypass the agent's protection by using macOS Recovery Mode.

1. Restart the Mac and boot into Recovery Mode (Hold Command+R for Intel Macs, or hold the Power button for Apple Silicon Macs).
2. Once in the Utilities menu, open Terminal.
3. You will need to delete the agent's service user configuration. Run the following command (replace [DISKNAME] with your drive name, usually Macintosh HD):
   rm -f /Volumes/[DISKNAME]/private/var/db/dslocal/nodes/Default/users/trapspanw.plist
4. Exit Terminal and restart the Mac normally.
5. Once the Mac boots back up, open a standard Terminal and delete the service account from the system:
   sudo /usr/bin/dscl . -delete /Users/trapspanw

After completing these steps, the agent's core identity will be removed, allowing you to either run the uninstaller or manually delete the /Library/Application Support/PaloAltoNetworks/ folder.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[ThisizAmen]

Thank you for your response @susekar !

Right now i am unable to test this let me try these tomorrow and i will let you  know if it's worked or not.

[susekar]

Sure!! @ThisizAmen