unwanted installation of crtex xdr

[info]

Hi,

Since yesterday, one of my customers have the software cortex xdr on their computer. But thy don't have cortex licence, and i don't work with cortex xdr. What can i do ?

[YavuzAkturk]

The uninstall password may have been left as the default. You can try that first. Open a cmd with administrator privileges, enter the installation folder with the command cd “C:\Program Files\Palo Alto Networks\Traps”, and run the command “cytool protect disable” to disable tamper protection. Then you can try uninstalling.

The default uninstall password should be “Password1”.

[susekar]

Hello @info,

Greetings for the day.

If your customer has the Cortex XDR agent installed but does not have a license and does not wish to use the software, the recommended course of action is to perform a clean uninstallation of the agent. Because standard uninstallation typically requires a password managed through the Cortex XDR console (which you do not have access to), you will likely need to use the Cortex XDR Cleaner tool or manual removal methods.

 

1. Identifying the Source of Installation

Cortex XDR agents do not install themselves automatically; they require a specific installation package containing a unique distribution ID to register with a tenant. You should verify with the customer's internal IT or security teams whether another department or a previous service provider deployed the software.

 

2. Standard Uninstallation (Windows)

You can attempt a standard uninstallation through the Windows Apps & Features or Programs and Features menu.

• If prompted for an uninstallation password, you can try the default value: password1.

• If the default password does not work and you cannot retrieve the password from a management console, you must use the Cortex XDR Cleaner tool.

---

3. Using the Cortex XDR Cleaner Tool:

The Cortex XDR Cleaner tool is designed to remove the agent and all its components when standard uninstallation methods are unavailable, such as when a license has expired or console access is lost.

Attaching the latest Cleaner tool to the files in this post. (Version 9.0).

Uninstallation via Safe Mode (Windows)

If the cleaner tool requires a password you do not have, follow these steps:

1. Boot the machine into Safe Mode.

2. Open a command prompt as an administrator and execute the following commands to stop the agent services:

sc stop cyverak
sc stop cyvrmtgn

3. Run XDR Cleaner.exe as an administrator.

4. Reboot the machine and run the cleaner tool a second time to ensure all remnants are removed.

 

4. Uninstallation on macOS

If the software is installed on a Mac, use the following procedure:

1. Navigate to:

/Library/Application\ Support/PaloAltoNetworks/Traps/bin

2. Locate and run Cortex XDR Uninstaller.app.

If prompted for a password or token that you do not have, you may need to use terminal commands to manually unload the Cortex daemon and remove related database files.

For further assistance without an active support license, the customer should reach out directly to their Palo Alto Networks account representative.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[info]

Hi and thanks for your reply. Some details about my issues :

- i m the IT of the company since 1 year and i didn't install cortex XDR.

- There are 2 computers with the cortex XDR sofwtare installed on, this 2 computers are the last computer used with their old IT company.

- cortex XDR don't appars in list of software and cannot be uninstalled by the usual way. And i cannot find the files in program files, even i display hiden files

- so the result is that i cannot run the XDR cleaner.exe because i don't know where to find it.

Thanks so much for your reply