Uninstall the Cortex XDR Agent for Windows - Administrator Guide - 8.3 - Cortex XDR - Cortex XDR Agent - Advanced Endpoint Protection - Cortex - Security Operations

Cortex XDR Agent Administrator Guide

Product
Cortex XDR
Cortex XDR Agent
Version
8.3
Creation date
2024-01-02
Last date published
2024-07-04
Category
Administrator Guide
Abstract

Learn how to uninstall the Cortex XDR agent from a Windows endpoint.

You can uninstall the Cortex XDR agent using any of the following methods on a Windows endpoint:

After you uninstall the agent, the endpoint is no longer protected by the Security policy of your company and the license returns to the pool of available licenses.

Manually Uninstall the Cortex XDR Agent for Windows

Use the following workflow to manually uninstall the Cortex XDR agent. If you intend to use Cytool in Step 1, ensure that you know the uninstall password before performing this procedure.

  1. Use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:

    • Run the Cytool protect disable command.

    • Apply an Agent Settings profile that disables XDR Agent Tampering Protection on the endpoint.

  2. Select StartControl Panel(Programs)Programs and Features.

  3. Select Cortex XDR from the list and then Uninstall.

  4. When prompted to continue uninstalling, click Yes and acknowledge any notifications.

Uninstall the Cortex XDR Agent for Windows Using Msiexec

Use the following workflow to uninstall the Cortex XDR agent using Msiexec. If you intend to use Cytool in Step 1, ensure that you know the uninstall password before performing this procedure.

  1. If you are uninstalling XDR Agent using the MSI file via SCCM or another software management system, use one of the following methods to disable the Cortex XDR agent security protection on the endpoint:

    • Run the Cytool protect disable command.

    • Apply an Agent Settings profile that disables XDR Agent Tampering Protection on the endpoint.

  2. Use one of the following options to open a command prompt as an administrator:

    • Select StartAll ProgramsAccessories. Then right-click Command prompt and Run as administrator.

    • Select Start. In the Start Search box, type cmd. Then, to open the command prompt as an administrator, press CTRL+ SHIFT+ ENTER.

  3. Run the msiexec command followed by one or more of the following options or properties:

    For example, to uninstall the Cortex XDR agent using the cortexxdr.msi installer with the specified password and log verbose output to a file called uninstallLogFile.txt, enter the following command:

    C:\Users\username>msiexec /x c:\install\cortexxdr.msi /l*v c:\install\uninstallLogFile.txt