Is It Possible To Disable The Sensor Without Administrative Rights?
Article ID: 287306
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Is it possible to disable the EDR sensor without Administrative rights on the endpoint?
Environment
- Carbon Black Sensor: All Versions
- Windows: 7.2.0
- Linux: 7.5.0
- macOS: 7.4.0
Resolution
- A sensor in tamper detection or none can be disabled with administration rights.
- Enabling tamper protection will stop administatrator from disabling the sensor.
- If App Control is used in conjunction with EDR, the Rapid Config should be enabled for CB Response Tamper Protection.
Additional Information
Feedback
Yes
No
Powered by
