Hello,
We had an issue of some computers getting disconnected status in XDR. In Lansweeper the status of XDR was disabled. After a long discussion with local support we came out with a nice procedure that allows to reconnect those client without reinstallation.
Assume we have a laptop lt00666 with a XDR client installed but disconnected from XDR console.
Open a command line to swclt00666 using Sysinternaltools tool psexec64
Psexec64.exe \\swclt00666 cmd
Move to XDR client dir
cd c:\Program Files\Palo Alto Networks\Traps
Get XDR client info
c:\Program Files\Palo Alto Networks\Traps>cytool.exe enum
Process ID Agent Version
1072 7.2.1.2718
Go to your XDR console and display Agent Installations
Make sure you have package ID enabled in default view
Copy ID for XDR version of the disconnected station - it will be long alphanumeric string (it is good to have it prepared for most common version you use so you do not have to look up at the console)
Issue a command to reconnect device to our XDR server (this is one line)
c:\Program Files\Palo Alto Networks\Traps>cytool reconnect force 1d7b234343434343444cc
There will be no prompt displayed and you have to enter (paste) uninstallation password. After you enter it and press enter the device will display:
Enter supervisor password:
c:\Program Files\Palo Alto Networks\Traps>
The laptop should already be visible in console. Upgrade to latest version and it is finished.
Procedure works very nice for us and I hope that it will save some time for the community also.
@Miroslaw_Iwanowski wrote:Hello,
We had an issue of some computers getting disconnected status in XDR. In Lansweeper the status of XDR was disabled. After a long discussion with local support we came out with a nice procedure that allows to reconnect those client without reinstallation.
Assume we have a laptop lt00666 with a XDR client installed but disconnected from XDR console.
Open a command line to swclt00666 using Sysinternaltools tool psexec64
Psexec64.exe \\swclt00666 cmd
Move to XDR client dir
cd c:\Program Files\Palo Alto Networks\Traps
Get XDR client info
c:\Program Files\Palo Alto Networks\Traps>cytool.exe enum
Process ID Agent Version
1072 7.2.1.2718
Go to your XDR console and display Agent Installations
Make sure you have package ID enabled in default view
Copy ID for XDR version of the disconnected station - it will be long alphanumeric string (it is good to have it prepared for most common version you use so you do not have to look up at the console)
Issue a command to reconnect device to our XDR server (this is one line)
c:\Program Files\Palo Alto Networks\Traps>cytool reconnect force [omitted]
There will be no prompt displayed and you have to enter (paste) uninstallation password. After you enter it and press enter the device will display:
Enter supervisor password:
c:\Program Files\Palo Alto Networks\Traps>
The laptop should already be visible in console. Upgrade to latest version and it is finished.
Procedure works very nice for us and I hope that it will save some time for the community also.
Hi @Miroslaw_Iwanowski ,
Thank you for posting your clever reconnection solution using psexec!
If I were to make a recommendation, I would omit the trailing tenant ID mentioned after the "cytool reconnect force" command as it is sensitive information unique to your XDR tenant.
