Uninstall agent rom MacOS

[iscott]

Hello,

We want to uninstall an agent from MacOS, but we do not have the admin password. And we can't reset the password because the tenant was deleted it. So the agent does not have administration from web console.

I try with "Passowrd1", it doesn't work.

Does someone know how to uninstall it? I know that for Windows, there is a "special cleaner" to delete the agent. But for MacOS, I don't know.

Regards, 

[gjenkins]

Hi @iscott,

Unfortunately, given that you don't have the admin or uninstall passwords or a valid connection to the XDR tenant from the endpoint to initiate the uninstall from there, the best next step would be a factory reset or a reimaging of the endpoint.  Unlike Windows, the MacOS Cortex XDR Agent does not have a cleaner. It does have an uninstaller builtin, but you would need the uninstall password for that, so I could only offer a factory reset in this case.

[iscott · Accepted solution]

Hello, @gjenkins 

Thanks for your answer. I know that has been past some months. What you said is correct. There is no cleaner for macOS. But, if you open a case, the TAC engineers will help with a script.

It is important to underline, for the community, that these delete tools are not public. In order to don't allow final users to uninstall the agent, without the right company permissions.

Please, do not share these Cortex XDR delete tools and scripts on public websites.