Uninstall vs Using Agent Cleaner

[pdysart]

When an IT admin uninstalls Cortex XDR from an endpoint does it remove that endpoint from the XDR Console?

When they use the Agent Cleaner to remove XDR from an endpoint does it remove that endpoint from the XDR Console?

We are running into duplicate endpoints when Admins install new versions manually: Just trying to better understand what is causing this.

[eluis · Accepted solution]

Hi Pdysart, 

the standard and recommended way to uninstall agents is through the console. This is the way to maintain a clean and non-duplicated infrastructure. 

The agent cleaner is for emergencies when for example you cant uninstall from the console because you've lost the admin password to uninstall the agents. In this case you boot into secure windows mode and use the cleaner without the need of a password. 

Im not sure if once you uninstall with the cleaner and before the console realizes that you have removed an agent, you install it again manually and that might be the reason whey you are getting duplicates. As I said Im not totally sure of how you are operating to get your results.

If you are getting duplicates without any reason and you believe that this is a malfunction or bug, please open a TAC support ticket. 

And be aware: always try to do everything from the console to avoid any mismatch between the console and the reality.

Hope this helps,

Luis