XDR agent reboot recover everytime

[tlmarques]

Hi guys,

Recently, we identified several computers running Cortex XDR version 9.2.0.120 with Content Version 2340-38788.

After the machines start, connect to the tenant, and receive the latest content/information, they start rebooting approximately every minute.

The Windows message displayed is:

“You’re about to be signed out”
“Reinício agendado em 1 minuto devido ao recover do cortex”

The machine then restarts after one minute. The message indicates that the restart is being scheduled due to Cortex recovery.

So far, the only solution we have found is to boot the machine into Safe Mode, stop the Cortex XDR services, and then remove/uninstall Cortex XDR.

After that, we reboot the machine, reinstall Cortex XDR, and the problem is resolved.

One additional point that may be relevant: most of our PCs are currently running Cortex XDR version 9.3.0.231 with Content Version 2390-40333.

The fact that these affected machines are running 9.2.0.120 / Content 2340-38788 may indicate that they were offline for some time and therefore did not receive the latest Cortex XDR version/content.

However, even if the machines were offline for an extended period, we don't understand why they would enter Recovery Mode after reconnecting and receiving the latest information. Being offline should not, by itself, explain why Cortex would trigger this behavior.

This is very important for us to understand because we have more than 8,000 devices, and I’m concerned that this issue could potentially start affecting a much larger number of machines.

Has anyone experienced this behavior before, particularly with Cortex XDR 9.2.0.120 / Content Version 2340-38788?

Do you know what could trigger the Cortex Recovery mechanism in this scenario, and whether there are any known issues related to upgrading from this older version/content?

Any information about the root cause, known issues, or recommended troubleshooting steps would be greatly appreciated.

Thanks!

[susekar]

Hello @tlmarques ,

Greetings for the day.

Based on the reboot message “Reinício agendado em 1 minuto devido ao recover do cortex”, the reboot appears to have been initiated by the Cortex XDR Health Helper (xdrhealth) / recovery mechanism to remediate an agent issue.

-This can occur when an endpoint reconnects after being offline for an extended period and starts synchronizing agent/content updates. If an installation or upgrade is interrupted or encounters a driver/service issue, the recovery mechanism may initiate a reboot to complete the remediation. If the underlying issue remains, this can result in repeated reboots.

Recommended checks:

• Review xdrhealth.log for Health Helper and reboot activity.
• Check MsiSuspendedInstallation.log for interrupted MSI installation/rollback activity.
• Review trapsd.log for agent, driver, or recovery-related errors.
• If the endpoint remains in a reboot loop, boot into Safe Mode, cleanly remove the Cortex XDR agent, and reinstall the required supported agent version.
  
  

For the wider environment:
For a large deployment, we recommend using staged/delayed agent and content upgrades and identifying long-term offline endpoints before allowing them to reconnect and synchronize. This can help avoid a large number of endpoints upgrading simultaneously.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar