EDR: Why does the Sensor Service Keep Restarting?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

The Carbon Black EDR Sensor Service is restarting

Environment

• EDR Sensor: All Supported Versions
• Windows: All Supported Versions

Resolution

• If the following is seen in the c:\Windows\CarbonBlack\sensor.log     

Shutting down in response to SERVICE_CONTROL_STOP request...

• A restart command has been sent to the sensor from the EDR Console       
• Or a restart command from a third party script or application has restarted the service