EDR: Uninstall Windows Sensor if Protection Password has Changed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Uninstall a Windows sensor while in Tamper Protection mode and the password has changed or was deleted.

Environment

• EDR Windows Sensors: 7.2+

Resolution

A)  If a tamper protection password was changed, the older password may reside in History.

1.  In the EDR Console > Sensors > Group > Settings > Advanced > Tamper Override Password.  Click History to list the recent passwords.

2.  The command to disable tamper protection is:

C:\Windows\CarbonBlack\CbEDRCLI.exe <override_password>

3.  Uninstall Carbon Black sensor from a directory outside of Carbon Black's directory.

C:\Windows\CarbonBlack\uninst.exe

B)  If the tamper protect password was deleted.

1. Disable Microsoft Protection API via Safe Mode.

a.  From the login page, hold down the Shift key + select Power > Restart.    Keep holding down the Shift key past reboot until a screen with options appears.

b.  Select "Troubleshoot" block.

c.  Select "Advanced Options" block.

d.  Select "Startup Settings" block.

e.  Read the options carefully as they may have changed.  Select the option similar to "Disable early launch anti-malware protection".  It was option 8 as of this writing.

2.  The system reboots and tamper protection should be removed. 
3.  Uninstall Carbon Black sensor.

C:\Windows\CarbonBlack\uninst.exe