EDR: Is it Possible to Prevent the Uninstall of the Sensor?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Is it possible to prevent the uninstall of the Sensor? 

Environment

• EDR (formerly CB Response): 6.x and Higher
• App Control (formerly CB Protection) Agent: 7.2 and Higher
• App Control Server: 8.x and Higher

Resolution

At this time there is no native feature in EDR itself to prevent the uninstall or require a password

Additional Information

• App Control has the Rapid Config "CB Response Tamper Protection" which can be setup to prevent the uninstall of the Sensor but it won't prevent the service from being stopped
• EDR itself only has Tamper Detection on Windows