How to Uninstall Cortex with disabling anti-tampering protection

[Zaffrul]

Hi All,

Anyone can help how to uninstall Cortex XDR with disabling anti-tampering protection?I am trying to uninstall from SCCM and due to the anti-tampering protection, it require password to disable the protection first before i can proceed with the uninstallation. Perhaps any bat script on this that i can use it.

Regards,

Zaffrul

[kiwi]

Hi @Zaffrul ,

Please check the following discussion on the same topic:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-uninstall-without-password-an...

Kind regards,

-Kiwi.

[Zaffrul]

Hi Kiwi,

Thanks for the respond. The link given is not the same topic as mine. My issue is, i can't uninstall Cortex XDR from SCCM due to anti-tampering protection. It require to insert the supervisor password in order to proceed with uninstallation. I have the password but i don't know what is the correct parameter to insert in bat script for disabling the anti-tampering protection.

Regards,

Zaffrul

[kiwi]

Hi @Zaffrul ,

Gotcha, you can use the cytool utility that comes with the agent. You should be able to find it under 'C:\Program Files\Palo Alto Networks\Traps\cytool.exe'.

Type the following command to disable Anti-tampering:
cytool protect disable

It will ask for the password

This allows you to stop services, uninstall or do whatever you need to do.

Source:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Cytoo...

Kind regards,

-Kiwi.

[Mudhireddy]

adding along those above points...Yeah, I tested using >cytool runtime stop to uninstall the xdr-agent at the endpoint for testing. Password/temp-token is mandatory