> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md).
# Uninstall the Cortex XDR agent
If you want to uninstall the Cortex XDR agent from the endpoint, you can do so from the Cortex XDR tenant at any time. You can uninstall them from an unlimited number of endpoints in a single bulk action using the **Action Center**. You can also uninstall each endpoint one-by-one, using the **All Endpoints** page. Uninstalling an endpoint triggers the following lifespan flow:
* Once you uninstall the agent from the endpoint, the action is immediate. All agent files and protections are removed from the endpoint, leaving the endpoint unprotected.
* The endpoint status changes to **Uninstalled** , and the license returns immediately to the license pool. After a retention period of 7 days, the agent is deleted from the database and is displayed in Cortex XDR as **Endpoint Name** - `N/A (Uninstalled)`.
* Data associated with the deleted endpoint is displayed in the **Action Center** tables and the Causality View for the standard 90-day retention period.
* Alerts that already include the endpoint data at the time of the alert creation are not affected.
{% hint style="info" %}
### Note
* Before upgrading a Cortex XDR agent 7.0 or later running on macOS 10.15.4 or later, you must ensure that the System Extensions were approved on the endpoint. Otherwise, if the extensions were not approved, after the upgrade the extensions remain on the endpoint without any option to remove them which could cause the agent to display unexpected behavior. To check whether the extensions were approved, you can verify that the endpoint is in a **Fully Protected** state in Cortex XDR or execute the following command line on the endpoint to list the extensions: `systemextensionsctl` list. If you need to approve the extensions, follow the workflow explained in the Cortex XDR agent administration guide for approving System Extensions.
* For iOS and Android endpoints, uninstallation will reset account registration and data, but the app itself will remain on the device until removed locally by the user. The endpoint will be disconnected, and the user will no longer be able to connect the app to the tenant account.
{% endhint %}
Uninstall endpoints using the Action Center
1. Log in to Cortex XDR.
Go to **Incident Response** → **ResponseAction Center**.
2. Click **+ New Action**.
3. Select **Agent Uninstall**.
4. Click **Next**.
5. Select the target endpoints (up to 100) for which you want to uninstall the Cortex XDR agent.
Tip
If needed, Filter the list of endpoints by attribute or group name.
6. Click **Next**.
7. Review the action summary and click **Done** when finished.
8. To track the status of the uninstallation, return to the **Action Center**.
Uninstall endpoints using the All Endpoints page
1. Log in to Cortex XDR.
Go to **Endpoints** → **All Endpoints**.
2. Find and then right-click the agent that you want to uninstall, and select **Endpoint Control** → **Uninstall Agent**.
3. In the confirmation dialog box that appears, select **I agree**, and click **OK**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.