> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/uninstall-the-cortex-xdr-agent-for-mac.md).

# Uninstall the Cortex XDR Agent for Mac

Learn how to uninstall the Cortex XDR agent from a Mac endpoint.

From the Cortex XDR management console, you can uninstall the Cortex XDR agent on an endpoint (refer to *Uninstall the Cortex XDR Agent* in the Administrator's Guide for your Cortex XDR license type). You can also uninstall the agent from the endpoint directly. On Mac endpoints, you can use the uninstaller that comes with the Cortex XDR agent installation package to uninstall the agent software. To uninstall the agent, you must also supply the uninstall password.

After you uninstall the agent, the endpoint is no longer protected by Cortex XDR security policies and the license returns to the pool of available licenses.

{% hint style="info" %}

### Note

* Starting with macOS 10.15.4, the operating system requests the user approval to remove the Cortex XDR agent from the endpoint and prompts the user on the endpoint to enter the operating system credentials during the uninstall process. After approval and authentication, the Cortex XDR agent continues the uninstall process.
* Before upgrading a Cortex XDR agent 7.0 or later running on macOS 10.15.4 or later, you must ensure that the System Extensions were approved on the endpoint. Otherwise, if the extensions were not approved, after the upgrade the extensions remain on the endpoint without any option to remove them which could cause the agent to display unexpected behavior. To check whether the extensions were approved, you can either verify that the endpoint is in Fully Protected state in Cortex XDR, or execute the following command line on the endpoint to list the extensions: `systemextensionsctl list`. If you need to approve the extensions, follow the workflow explained in the Cortex XDR agent administration guide for approving System Extensions, either manually or using an MDM profile.
  {% endhint %}

1. Run the Cortex XDR agent uninstaller.

   The uninstaller is part of the installation package that you downloaded from the Cortex XDR management console to install the agent (Endpoints → Endpoint Management → **Agent Installations**).
2. When prompted, enter the Cortex XDR agent uninstall password and click **OK**.

   The global uninstall password is defined in the ![gear.png](https://4007858819-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQoHlFRhZE0Pb9XqVtyr3%2Fuploads%2Fgit-blob-7304ef791dd19d08bc9d850b367cce11e38d629f%2F8c5d43c1221f896bcf83009b14fecabc3270e1a71a5ae961cdb05d3d889cb327.png?alt=media) **>** **Agent Configuration** of the Cortex XDR management console.
3. When prompted, enter the macOS credentials for a user that has permissions to uninstall apps and click **OK**.

   The uninstaller completes the uninstall process and removes the Cortex XDR agent and related files.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/uninstall-the-cortex-xdr-agent-for-mac.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.