EDR: How to Uninstall Sensor if MAC Kernel Panic Occurs

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To uninstall the EDR driver if a kernel panic is occurring.

Environment

• EDR (Formerly CB Response) sensors: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

1. Boot into Recovery Mode
   • https://support.apple.com/en-us/HT201314\
2. Open Disk Utility, and mount the Macintosh HD
3. Close Disk Utility and in the top bar select Utilities > Terminal
4. Run commands:

   cd /Volumes/Macintosh HD/Library/Extensions 
   rm -rf CbOsxSensor*

5. Reboot and login normally
6. Uninstall the sensor