You can uninstall the Cortex XDR agent from one or more
Windows, Mac, or Linux endpoints at any time.
If
you want to uninstall the
Cortex
XDR
agent from the endpoint, you can do so from the
Cortex
XDR
management console at any time.
You can uninstall the
Cortex
XDR
agent from an unlimited number of endpoints in a single
bulk action. Uninstalling an endpoint triggers the following lifespan
flow:
Once you uninstall the agent from the endpoint,
the action is immediate. All agent files and protections are removed from
the endpoint, leaving the endpoint unprotected.
The endpoint status changes to
Uninstalled
,
and the license returns immediately to the license pool. After a
retention period of 7 days, the agent is deleted from the database
and is displayed in
Cortex
XDR
as
Endpoint Name
-
N/A (Uninstalled)
.
Data associated with the deleted endpoint is displayed in
the
Action Center
tables and in the Causality
View for the standard 90 days retention period.
Alerts that already include the endpoint data at the time
of the alert creation are not affected.
Before upgrading
a
Cortex
XDR
agent 7.0
or later running on macOS 10.15.4 or later, you must ensure that
the System Extensions were approved on the endpoint. Otherwise,
if the extensions were not approved, after the upgrade the extensions
remain on the endpoint without any option to remove them which could
cause the agent to display unexpected behavior. To check whether
the extensions were approved, you can either verify that the endpoint
is in Fully Protected state in
Cortex
XDR
, or execute the following command line on the endpoint
to list the extensions:
systemextensionsctl list
.
If you need to approve the extensions, follow the workflow explained
in the
Cortex
XDR
agent
administration guide for approving System Extensions, either
manually or
using an MDM profile.
The
following workflow describes how to uninstall the
Cortex
XDR
agent from one or more Windows,
Mac, or Linux endpoints. To uninstall the
Cortex
XDR
app for Android, you must do so from the Android endpoint.
