Carbon Black Cloud: Sensor Install\Upgrade Fails Previously Uninstalled without Deregistration Code

search cancel

book

calendar_today

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Depending on the Sensor Version, one or more of the following symptoms may be observed:

In the Carbon Black Console (CBC) > Inventory > Endpoints page, the Device OS Version and Sensor Version are blank although normally these details are populated
CBC Service is not installed or running on the device
CBC Sensor is installed and functioning as expected, but install or upgrade fails

"Require code to uninstall sensor" is or was enabled on the CBC Policy at the time of sensor install
Sensor 3.2 and above uninstalled was attempted without providing the Deregistration Code and resulted in CBC tamper protection changing the permissions of certain cbc files and registry keys

In Sensor version 3.6.x and above, sensor will prompt with message "Uninstall is password protected. Please run uninstall.exe with a valid uninstall code." if deregistration code is required, but not provided.
If this issue has already occurred, please Open a Support Case for additional assistance.

In sensor versions 3.4 and below, we identified the following registry key and it's subkeys cannot be deleted because the permissions show they are owned by System. This was resolved in sensor 3.5 and above although there are other files and registry keys which are affected by the same issue depending on the sensor version installed
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CbDefenseWSC
```
This is only one possible cause for CBC tamper protection changing the permissions of certain cbc files and registry keys. It is possible that other situations which may result in the permission being changed for various other cbc files and registry keys

thumb_up Yes

thumb_down No