Uninstall the Cortex XDR Agent for Mac - Administrator Guide - 8.3 - Cortex XDR Agent - Cortex XDR - Advanced Endpoint Protection - Cortex - Security Operations

Cortex XDR Agent Administrator Guide
Product
Cortex XDR Agent
Cortex XDR
Version
8.3
Creation date
2024-01-02
Last date published
2024-07-04
Category
Administrator Guide
Abstract

Learn how to uninstall the Cortex XDR agent from a Mac endpoint.

From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to Uninstall the Cortex XDR Agent in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly by using the uninstaller that comes with the Cortex XDR agent installation package that you downloaded from the Cortex XDR management console to install the agent (Endpoints → Endpoint Management → Agent Installations).

After you uninstall the agent, the endpoint is no longer protected by Cortex XDR security policies and the license returns to the pool of available licenses.

Danger

To uninstall the agent, you need the uninstall password or a temporary token. See Manage Agent Tokens to obtain a temporary token.Manage Agent Tokens

Ensure that you extract the uninstaller from the installer package which is the same version as the Cortex XDR agent for Mac currently installed on the endpoint.

Ensure that the installer file, called Cortex XDR Uninstaller.app, is saved in the following location: /Library/Application\Support/PaloAltoNetworks/Traps/bin

  1. Run the Cortex XDR agent uninstaller Cortex XDR Uninstaller.app from: /Library/Application\Support/PaloAltoNetworks/Traps/bin.

  2. When prompted, enter the Cortex XDR agent uninstall password or temporary token, and click OK.

  3. When prompted, enter the macOS credentials for a user that has permissions to uninstall apps and click OK.

    The uninstaller completes the uninstall process and removes the Cortex XDR agent and related files.