CB Response: OSISoft Applications Unable to Read Sensor Registry

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

OSISoft Application is unable to complete when failing to read the Sensor's registry

Environment

• Carbon Black Response Sensor: All Versions
• Microsoft Windows: All Supported Versions
• OSISoft

Cause

The Carbon Black Response Sensor registries are protected from non-administrative users

Resolution

There are two options to get around this.

OSISoft solution

Run OSISoft as Local System user

 

RegEdit solution

1. Open Regedit as an Administrator
2. Right click on the below registry keys and select Permissions
   • hklm\software\carbonblack\config
   • hklm\system\currentcontrolset\services\carbonblackk
3. Add the user running OSISoft to the 'Group or users names' list
4. Give this user 'Full Control' permissions

Additional Information

Option 2 will open the Sensor registration to be modified or deleted by the user. Please use caution with making this modification