> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-reboot-requirements.md).

# Cortex XDR agent reboot requirements

Learn when Cortex XDR agent installation, upgrades, or uninstallation require an endpoint reboot, including Device Control and Secure Boot requirements in Cortex XDR.

Installing, upgrading, and uninstalling the Cortex XDR agent is designed to run without interrupting users. In most cases you do not need to reboot the endpoint, and protection starts as soon as the Cortex XDR agent registers with Cortex XDR.

### Upgrade

* The endpoint operating system might ask for a reboot during a Cortex XDR agent upgrade. **You don't need to reboot for the Cortex XDR agent upgrade to complete successfully.**
* **Exception:** if you use **Device Control** rules, reboot the endpoint after the upgrade so that the rules take effect.

For upgrade methods and limitations, see [Upgrade Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/upgrade-cortex-xdr-agents).

### Installation

The Cortex XDR agent starts protecting the endpoint after installation and registration, without a reboot. The following platform-specific steps can involve a restart:

| Platform            | When a restart may be needed                                                                                                                                                                                      |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Linux (Kernel Mode) | If UEFI Secure Boot is enabled, enroll the Cortex XDR kernel module certificate (MOK). The machine must reboot once to complete MOK enrollment. User Space (eBPF) mode does not load a kernel module.             |
| Linux               | If you change the SELinux operation mode (permissive or enforcing) after installation, restart the **Cortex XDR agent** (not the endpoint).                                                                       |
| Windows, macOS      | No reboot is required to start protection. On macOS, approve the system extensions and network extension, or deploy them with an MDM profile, so that the Cortex XDR agent reaches the **Fully Protected** state. |

### Uninstallation

You can uninstall agents from the console without a reboot. See [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent).

{% hint style="info" %}
Reboot behavior can differ between Cortex XDR agent releases. For the guidance that matches your release, see the [Cortex XDR agent documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/readme) and select your Cortex XDR agent version.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-reboot-requirements.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.