Carbon Black Cloud: How To Check DeviceID On Endpoint (Windows 3.6)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Explain the steps to confirm the DeviceID of a 3.6.x.x or lower Sensor on the machine where it is installed

Environment

• Carbon Black Cloud Sensor: 3.6.x.x and Lower
• Microsoft Windows: All Supported Versions

Resolution

CMD.EXE

1. Launch a command prompt (cmd.exe)
2. Run the following command

   find "RegistrationId" "C:\Program Files\Confer\cfg.ini"

3. The output will be in the following format

   RegistrationId=OrgID-DeviceID

Powershell

1. Launch Powershell.exe
2. Run the following command

   Select-String -Path 'C:\Program Files\Confer\cfg.ini' -Pattern RegistrationId

3. The output will be in the following format

   C:\Program Files\Confer\cfg.ini:<Line#>:RegistrationId=OrgID-DeviceID

Additional Information

• Confirming the DeviceID locally on the machine with the Sensor installed can be helpful in troubleshooting issues and reviewing Alerts and other Events within the Carbon Black Cloud Console
• For example, with the DeviceID you can review Events specific to that single device on the Investigate page by replacing <DeviceID> with the ID retrieved using the above method

  https://<DashboardURL>/investigate?selected[deviceId]=<DeviceID>&selected[selectedTab]=DEVICE&s[searchWindow]=ALL&s[c][DEVICE_ID][0]=<DeviceID>