Overview

Before you can uninstall Cortex XDR, you will need to have a Cortex installation package to protect the endpoint. This package can be obtained through the Cortex XDR online portal. Due to anti-tampering protect, you will be using a separate package to uninstall Cortex in safe mode.

Obtain a Cortex XDR Installation Package

Using An Existing Cortex XDR Package

Before uninstalling Cortex, make sure that you have an install file for Cortex. You can use a package that has already been crated by visiting https://royalelectric.xdr.us.paloaltonetworks.com/endpoints/distributions.

If you are in the home page, you can click on Endpoints > Agent Installations > right-click on an existing Cortex XDR agent > 64 bit installer > Download 64 bit installer (.msi).

Create New Agent Installation

If the available versions of Cortex that exist are old, you may want to create a new agent installation.

Select the desired version from the drop-down menu.

Uninstalling Cortex XDR

To uninstall Cortex, please boot the computer into safe mode with the minimal option. You can get to the system configuration Window by running msconfig:

Once in safe mode, run the attached xdrAgentCleaner.exe as admin. The removal process can take up to 15 minutes, so be patient even when you think the uninstaller has crashed. After the old version has been removed, install the updated version of Cortex that was downloaded from the portal or whatever is available when you're reading this KB.