XDR agent not accepting full disk permissions

[Daniel_Itenberg]

Hi, I have an agent that after installation insists that the full disk access permissions were not granted. however, said permissions are granted.

furthermore, said agent cannot be uninstalled. how can I force the agent to recognize that it has been given the full disk access permissions? 

[bbucao]

Hi Daniel_Itenberg,

Can you provide the OS version for the endpoint as well as what agent version you are installing?

Thanks,

Ben

[creddy]

Hi @Daniel_Itenberg 
I believe you are referring to MAC OS endpoints.
Can you try to reboot the endpoint once and see if that resolves the issue here.
Thank you!

[Vinothkumar_SBA]

Hi creddy,

We have already granted full disk permissions in macOS for Cortex XDR. However, we are still encountering the following popup:

The popup continues to reappear on the machine.

We are experiencing the same issues after a reboot in the cloud. Please help me

[RFischer2023]

absolutely exactly the same behavior here 😞

[MarcoMJ]

Hi, did you check this documentation? 

• https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.2/Cortex-XDR-Agent-Administrator-Guide/Insta...
• Refer to point 9

[RFischer2023]

Hey Marcos, as written above "We have already granted full disk permissions in macOS for Cortex XDR" I assume we did step 9 already 😉
But it seems there was an update on the agent, the message disappeared on my Mac.

[RFischer2023]

i was too early, it's back and just as annoying as before. full disk access for pmd and TrapSecurityExtenstion allowed, but doesn't help at all 😞

[jtalton]

Please check that full disk access is really granted. To confirm, go to System Settings >> Privacy & Security >> Full Disk Access and verify PMD and TrapsSecurityExtension are enabled for full disk access:

The next recommendation is to update macOS to the latest available version to see if the issue is resolved. 

If you have not already done so, please open a Support Case for additional troubleshooting by a TAC engineer to help resolve the issue. 

[RFischer2023]

Done this, looks the same, expect "Terminal".
But honestly it's easier to answer here as opening a ticket, so I just click it away until someone at PANW solved the issue 😉