EDR: How to uninstall EDR Sensor from Windows endpoints with App Control Agent Installed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to uninstall an EDR Sensor from Windows endpoints that also have an App Control Agent installed.

Environment

• EDR Sensors: All Supported Versions
• App Control Agents: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Disable EDR Tamper Protection: (Globally)

1. Log in to the App Control Console and navigate to Rules > Software Rules > Rapid Configs.
2. Check the box for Carbon Black EDR Tamper Protection > Action > Disable Rapid Config.
3. Uninstall the EDR Sensor.

Disable EDR Tamper Protection: (Per Endpoint)

1. Log in to the endpoint and use a command prompt to issue the following commands:

   cd "C:\Program Files (x86)\Bit9\Parity Agent\"
   dascli password GlobalPassword
   dascli kernelconfig CarbonBlackTamperProtection 0

2. Uninstall the EDR Sensor