Cb Defense: Sensor Reinstall Fails With Message "A newer or current version of Cb Defense Sensor 64-bit is already installed"
search cancel

Cb Defense: Sensor Reinstall Fails With Message "A newer or current version of Cb Defense Sensor 64-bit is already installed"

book

Article ID: 285550

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

The verbose MSI log (/L*vx) may show the following message
MSI (s) (XX:XX) [TimeStamp]: Product: Cb Defense Sensor 64-bit -- A newer or current version of Cb Defense Sensor 64-bit is already installed. 
To install this version, uninstall the current version first.

A newer or current version of Cb Defense Sensor 64-bit is already installed. To install this version, uninstall the current version first.
Action ended 16:20:49: LaunchConditions. Return value 3.
Action ended 16:20:49: INSTALL. Return value 3.

Environment

  • Cb Defense Sensor: All Versions
  • Microsoft Windows: All Supported Versions
  • Cb Defense Sensor uninstalled
  • Sensor Removal Tool has been run 
  • Subsequent install attempts fail

Cause

Registry keys identifying Cb Defense as installed were not removed when the Sensor was uninstalled through the Control Panel or when the Sensor Removal Tool was run

Resolution

  1. Backup the registry prior to making any changes
  2. Search for and delete the following keys if found
    HKEY_CLASSES_ROOT\Installer\Products\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{Cb Defense GUID} 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbDefenseWSC
  3. Search for additional registry keys
    1. HKEY_CLASSES_ROOT\Installer\Products
    2. Search for "confer" (no speech marks)
    3. Delete keys found in that path

Additional Information

  • Some registry key deletions may fail due to permissions
  • It may be necessary to take ownership of the registry key by changing ownership from System to the logged in administrator account
  • PS Exec (from SysInternals suite) can also be used to launch registry edit in order to delete keys owned by System