You can uninstall the Cortex XDR agent using any of the following methods on a Windows endpoint:
Uninstall from Cortex XDR (Refer to how you uninstall the agent in the Cortex XDR Administrator’s Guide.)
After you uninstall the agent, the endpoint is no longer protected by the Security policy of your company and the license returns to the pool of available licenses.
Manually Uninstall the Cortex XDR Agent for Windows
Use the following workflow to manually uninstall the Cortex XDR agent.
Use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:
Run the
Cytool protect disablecommand.Apply an Add a New Agent Settings Profile profile that disables XDR Agent Tampering Protection on the endpoint.
Select → → → .
Select Cortex XDR from the list and then Uninstall.
When prompted to continue uninstalling, click Yes and acknowledge any notifications.
Uninstall the Cortex XDR Agent for Windows Using Msiexec
Use the following workflow to uninstall the Cortex XDR agent using Msiexec.
Use one of the following options to open a command prompt as an administrator:
Select → → . Then right-click Command prompt and Run as administrator.
Select Start. In the Start Search box, type cmd. Then, to open the command prompt as an administrator, press CTRL+ SHIFT+ ENTER.
Run the
msiexeccommand followed by one or more of the following options or properties:Uninstall and logging options:
/x<installpath>\<installerfilename>.msi—Uninstall a package./l*v <logpath>\<logfilename>.txt—Log verbose output to a file.
For a full list of Msiexec parameters, see https://docs.microsoft.com/en-us/windows/desktop/Msi/command-line-options
For example, to uninstall the Cortex XDR agent using the cortexxdr.msi installer with the specified password and log verbose output to a file called uninstallLogFile.txt, enter the following command:
C:\Users\username>
msiexec /x c:\install\cortexxdr.msi /l*v c:\install\uninstallLogFile.txt