Uninstall Windows Sensor if Protection Password has Changed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Uninstall a Windows sensor while in Tamper Protection mode and the password has changed or was deleted.

Environment

• EDR Windows Sensors: 7.2+

Resolution

A)  If a tamper protection password was changed, the older password may reside in History.

1.  In the EDR Console > Sensors > Group > Settings > Advanced > Tamper Override Password.  Click History to list the recent passwords.

2.  The command to disable tamper protection is:

C:\Windows\CarbonBlack\CbEDRCLI.exe <override_password>

3.  Uninstall Carbon Black sensor from a directory outside of Carbon Black's directory.

C:\Windows\CarbonBlack\uninst.exe

B)  If the tamper protect password was deleted.

1. Boot Windows to safe mode
   
   From the login page, hold down the Shift key + select Power > Restart.    Keep holding down the Shift key past reboot until a screen with options appears.
   Select "Troubleshoot" block.
   Select "Advanced Options" block.
   Select "Startup Settings" block.
   Read the options carefully as they may have changed.  Select the option similar to "Disable early launch anti-malware protection".  It was option 8 as of this writing.
   
   
2. Launch CMD and uninstall Carbon Black sensor
   

   C:\Windows\CarbonBlack\uninst.exe
   reg delete "HKLM\SYSTEM\CurrentControlSet\Services\CarbonBlack" /f