Unable to remove traps agent from windows endpoint

[AsifSid]

Hi All,

I have come across a situation, where I am unable to remove traps agent from a windows systems, Below are the findings from this situations.

1) This perticular windows endpoint is unlicensed now meaning there is no communication between this endpoint and traps ESM server.

2) We tried removing traps using traps cleaner tool but while running this tool it says "SPROT is enabled please enter password to disabled it"

3) When we enter the password it says incorrect password (we know pssword is correct"

4)When we try to remove traps through control panel , it asks for the password and hence not accpeting the password.

5) We tried to install traps by overrighting the current installation. but during the traps setup window, The ESM server name and port number comes already hardcoded means we cant change the things which are already there.

 6) This unlicensed traps is blocking a perticular pdf on the system, so evenif i whielist that pdf , those changes will not take effect untill the communication is established.

I have opened a ticket with support people, but still if anyone has any clue , Please assist.

Regards

Asif Siddiqui

[thomaskoetsier]

Have you tried the default agent uninstall password? It's "Password1"

Failing that if you contact PAN support they should be able to provide you with a removal tool that will remove Traps entirely from the machine, without the need for a password. 

[MarcinSt]

Hi, @AsifSid

At the very begining: it is possbile to get rid of Traps agent without password. It needs to manual cleaning of registry (tricky part, you have to know what are you doing) and I wen thru this process with and without PANW's support.

Even if agent's services protects itself you can always boot windows in safe mode and use registry editor then just delete agent's files.

regards.

[SoporteITS]

Hi,

I have seen that in some cases, the Traps installation is not correct. In those cases, the cleaner does not work and the solution is to execute it in safe mode.

I have seen that if traps is stopped with the cytool, the you can execute the cleaner correctly. For those Endpoints that you can not access in safe mode because of different issues, you can try this.

Regards.

[AustinTapia]

Error: "Cleaner failed to disable SPROT or the current user is not privileged"

Solution:

Open cmd.exe

cd /d C:\Program Files\Palo Alto Networks\Traps\

cytool protect disable

Go to add or remove programs and select Cortex then click "Yes" on restarting and Cortex should be removed.

[jsoperman]

Have you tried Password1 as the uninstall password? I went through this myself, and that's what did the trick.

[cskoien]

@AustinTapia  thank you your steps worked for me for this error.

[JardaOn]

Thank you. Worked for me aswell!