Carbon Black Cloud: Sensor Install\Upgrade Fails Previously Uninstalled without Deregistration Code
book
Article ID: 289488
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Depending on the Sensor Version, one or more of the following symptoms may be observed:
In the Carbon Black Console (CBC) > Inventory > Endpoints page, the Device OS Version and Sensor Version are blank although normally these details are populated
CBC Service is not installed or running on the device
CBC Sensor is installed and functioning as expected, but install or upgrade fails
Environment
Carbon Black Cloud Sensor: Version 3.2 - 3.4
Microsoft Windows: All Supported Versions
Cause
"Require code to uninstall sensor" is or was enabled on the CBC Policy at the time of sensor install
Sensor 3.2 and above uninstalled was attempted without providing the Deregistration Code and resulted in CBC tamper protection changing the permissions of certain cbc files and registry keys
Resolution
In Sensor version 3.6.x and above, sensor will prompt with message "Uninstall is password protected. Please run uninstall.exe with a valid uninstall code." if deregistration code is required, but not provided.
If this issue has already occurred, please Open a Support Case for additional assistance.
Additional Information
In sensor versions 3.4 and below, we identified the following registry key and it's subkeys cannot be deleted because the permissions show they are owned by System. This was resolved in sensor 3.5 and above although there are other files and registry keys which are affected by the same issue depending on the sensor version installed
This is only one possible cause for CBC tamper protection changing the permissions of certain cbc files and registry keys. It is possible that other situations which may result in the permission being changed for various other cbc files and registry keys