Disabling anti-tampering for a single endpoint

[pdysart]

We have XDR Agent Tampering Protection enabled for all of our 60,000+ endpoints.

Sometimes we need local tech coordinators to uninstall/reinstall XDR on the machine (usually an old corrupted agent version that will not upgrade or scan etc...)  

Is there a way to disable anti-tampering on specific endpoints without changing the Policy and effecting all of the other devices on the same policy?  

I am looking for a better solution to remove XDR from these devices than sending the Agent Cleaner and anti-tampering password.

[nikoolayy1 · Accepted solution]

You may try creating new "Agent Settings Profiles" profile with anti tampering stopped attach it to a new policy rule that is before your policy rule for the 60 000 stations and then set the target to the AD user / AD group or Endpoint group you want.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-xql-language-reference/stages-command...

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/defin...

[nikoolayy1]

If you managed to get the needed answers, please flag the question as answered.

[PBurns]

You have the option of using the Cytool utility that comes as part of the agent. Cytool can be found at 'C:\Program Files\Palo Alto Networks\Traps\cytool.exe'. At an admin command prompt run 'cytool protect disable'. You can then stop services, uninstall or do whatever you need to do now tamper protect is disabled. 

echo passwordhere| "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" protect disable

For more information of Cytool and its usage see the agent admin guide:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-8/cortex-xdr-agent-admin/cortex-xdr-agent-for-...