> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/user-management/disable-a-user.md).

# Disable a User

In Cortex XSOAR, you can temporarily disable or [Remove a User](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/remove-a-user.md). Users should be disabled if they need access at a later date. All user information is maintained for disabled users.

If the user is assigned to incidents or tasks or is the owner of a dashboard, these assignments do not automatically change when the user is disabled.

{% hint style="info" %}

### Tip

* You cannot disable or remove the default admin user created at system installation.
* We recommend changing incident and task assignments manually before disabling users.
  {% endhint %}

After you disable a user, any dashboards the user has created can only be deleted by the default admin via the API, using the dashboard ID. To get the dashboard ID, click on the gear icon on the relevant dashboard page, export the dashboard as a JSON file, and copy the dashboard ID from the file. Send a request to **`/dashboards/:id route`**. For example, **`DELETE /dashboards/9dd50ef1-8a2b-48a5-821e-8238a87e2bdc`**.

Any reports the user has created remain available. Reports are not owned by specific users and can be edited or deleted by other users.

{% hint style="info" %}

### Note

When a user is disabled, the user’s API keys are not revoked, as opposed to removing a user.
{% endhint %}

1. Reassign incidents and tasks.
   1. Go to the **Incidents** page and search for **`-status:closed owner:`*****`user_name`*** to find any incidents the user is assigned to. Reassign any open incidents to another user.
   2. Go to the **Incidents** page and search for **`-status:closed investigation.users:`*****`user_name`***. Reassign tasks to another user.

      When a user is assigned a task in an incident, the user is added to the incident. This search finds all incidents where the user is a participant.
2. Disable the user.
   1. Go to **Settings** → **USERS AND ROLES** → **Users**.
   2. Select the user you want to disable.

      If the user is a default admin, you need to select Roles and deselect Set as Default Admin.
   3. Click Disable.
   4. Confirm that you want to disable the user.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/user-management/disable-a-user.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.