Cortex XDR Agent 7.9 for Windows

To install, use, upgrade, and uninstall the Cortex XDR agent 7.9 on Windows endpoints, see the references in this topic.

The Cortex XDR agent protects Windows endpoints by preventing known and unknown malware from running on those endpoints and by halting any attempts to leverage software exploits and vulnerabilities. The agent enforces Security policy for your organization as defined in Cortex XDR. When a security event occurs on an endpoint, the agent collects forensic information about that event that you can use to analyze the incident.

The following topics describe how to install and use the Cortex XDR agent for Windows.

Install the Cortex XDR agent on unsupported-ACS OS versions

Microsoft Trusted Signing (Azure Code Signing) Directive

Since March 2023, Microsoft request security vendors to sign binaries using Trusted Signing (formerly Azure Code Signing). As a result, Cortex XDR agent versions require a specific Microsoft Windows patch. Note that any machines without this Windows patch are not able to install or upgrade to newer versions of Cortex XDR agent. This mainly impacted Windows machines running Windows 10 or below; Windows 11 machines have this patch pre-installed. Windows 7 machines must have an extended support license in order to install the patch. Additional information about the security patch and the specific patch numbers required per operating system build, KB5022661/KB4474419 . In cases where the Microsoft security patch has since expired, ACS support is achieved by installing cumulative updates after the release of the initial KB patch.

Available in agent versions 7.9.103-CE and 8.3-CE: To override the default behavior, admin must provide an MSI flag, NO_ACS_SUPPORT=1, as a parameter to the installer. This flag indicates that the installation is to be made on an ACS-unsupported operating system. A fresh installation is needed for using this flag.

Note

The NO_ACS_SUPPORT flag cannot be provided as part of an existing Cortex XDR agent upgrade.

If upgrading from a 7.5-CE release line to 7.9-CE or 8.3-CE, even without explicitly providing the installer flag, the installer will detect that ACS is unsupported and will treat the installation as if the flag was given.

Later versions of Cortex XDR agent automatically detect an ACS-unsupported OS and allow the installation to complete successfully.