EDR: How to Uninstall a Sensor via CMD Line When cbsetup.msi was Used for GPO Installation

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to uninstall an EDR sensor silently via command line when it was originally installed using the Windows MSI for GPO Installation package.

Environment

• EDR (formerly CB Response) Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Retrieve the Identifying number of the Sensor by using the following 2 steps
2. Run the following cmd in powershell
   • Get-WmiObject -Class Win32_Product | Where-Object -FilterScript {$_.Name -Like "CarbonBlack Sensor"} | Format-Table Name, IdentifyingNumber
           OR
   • Get-WmiObject -Class Win32_Product | Where-Object -FilterScript {$_.Name -Like "VMware Carbon Black EDR Sensor"}
3. This will return the Identifying number e.g.
   • Name                             IdentifyingNumber
     ----                                  -----------------
     CarbonBlack Sensor     {60F5B90A-1D6E-43CF-933F-5E5CFDCAD53C}
4. Copy the Identifying number including the curly brackets
5. Open elevated cmd prompt and execute the following silent uninstallation
   • MsiExec.exe /qn /x{60F5B90A-1D6E-43CF-933F-5E5CFDCAD53C}