CB Defense: How to Confirm Sensor is Running as a Protected Service

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Confirm if Sensor service is running as a protected service (protected by Windows)

Environment

• CB Defense PSC Sensor: 3.4.0.1016 and higher
• Microsoft Windows: Windows 10 1703 and higher

Resolution

1. Open a command prompt
2. Run the "sc qprotection" command to confirm Sensor service status

   sc qprotection cbdefense

3. The results will show the service protection level

   SERVICE cbdefense PROTECTION LEVEL: ANTIMALWARE LIGHT.

Additional Information

The "sc qprotection" command can also be run against the CbDefenseWSC service