Problem uninstalling Cortex XDR Agent

[Scott103]

I often have the problem that the host loses connection to Cortex console due to a failed agent update and I cannot uninstall the agent on it and reinstalling the agent results in a rollback. There is a file named "tdevflt.sys" left in the "C:\Program Files\Palo Alto Networks\Traps" folder that prevents me from reinstalling the agent. The only thing I can do is reinstall the operating system, because deleting the file forcibly results in a problem with the I/O devices. Is there any tool I can use to completely remove the remains of the Cortex agent from the host so I can reinstall it??

[malalade]

Yes, there is a tool you can leverage in that situation.

We recommend you open a support case with Palo Alto Networks Support - https://support.paloaltonetworks.com/

They will securely provide you the appropriate version of Cortex uninstaller tool and the process without re-installing the OS.

------------------

In future, to cleanly uninstall Cortex XDR from endpoints, disable tamper protect first before you start uninstall process.
https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-4/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[fmoixsante]

Hi there,

as @malalade stated the best course of action would be to open a case with support but not just for the so-called "XDRcleaner" but to find out why "tdevflt.sys" prevents you from uninstalling/upgrading the agent.

By the way, do you start the upgrade process from the XDR console?