Cb Defense: PSC Console Uninstall Failing For Sensor 3.2.x+

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Sensor shows as Deregistered on Endpoints page
• New Event data for Sensor still showing on Investigate and Alerts pages
• Sensor still installed and running on endpoint
• Sensor eventually uninstalls within ~24 hours

Environment

• Cb Defense PSC Console: August '18 build and higher (0.39.x+)
• Cb Defense Sensor: 3.2.x+
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Uninstall/deregistration sent from Web Console

Cause

Uninstall/deregistration signal not being received correctly by Sensor

Resolution

This will be fixed in a future version of the PSC Console and Sensor.

Additional Information

• The fix for this issue will be documented in a future version of the Release Notes, with DSER-10342 and DSEN-3752 noted
• The sensor typically will receive the uninstall hint in a delayed manner, but this can take roughly 24 hours
• A workaround has been identified to get the uninstall to occur more quickly

Workaround

1. Log into Cb Defense Web Console
2. Go to Endpoints
3. Find desired Device Name and check the box on the far-left
4. Click Take Action > Change Policy
5. Select desired Policy from drop-down
6. Click Change