Carbon Black Cloud: Sensor Upgrade Failing To Install After Initial GPO/SCCM Deployment

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Original install utilized GPO or SCCM
• Uninstallation of previous sensor and installing over the top via GPO/SCCM/Unattended
• Manual upgrade fails and the current version is not upgraded

Environment

• Carbon Black Cloud sensor: All Versions
• Microsoft Windows: All Supported Versions

Cause

Additional checks were added to verify that sensors installed via GPO are configured by GPO to allow updates to be pushed from the Cloud or installed manually.

Resolution

1. Open regedit and navigate to HKEY_CLASSES_ROOT\Installer\Products\{Cb Defense GUID}
2. Within this registry, take a note of the ‘ProductIcon’ Data

   Example
   C:\WINDOWS\Installer\{Product Code}\MainIcon.ico

3. Navigate to C:\WINDOWS\Installer\ and delete the folder with same {Product Code} as above
4. Delete the {Cb Defense GUID} from the registry
5. Re-run the installer

Additional Information

• The {Cb Defense GUID} is a string of characters randomly generated for each new sensor install and is not the same as the Product Code which is the same for each Sensor Version
• This change was made to prevent the issue described https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-Sensor-Uninstalled-After-Attempted-Upgrade-GPO/ta-p/43474