Can the Sensor Be Uninstalled While in Bypass or Quarantine?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Is it possible to uninstall a Sensor that is in Bypass or Quarantine status?

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows OS: All Supported Versions
• MacOS: All Supported Versions
• Linux OS: All Supported Versions.

Resolution

Yes, a Sensor in either status can be uninstalled through supported methods.

Additional Information

• If a Sensor is in a Policy where 'Require code to uninstall sensor' is enabled, then the Deregistration or Uninstall Code is required for command line uninstalls.
• Sensors in Bypass state disable tamper protection so the sensor can be modified or altered, thus even if 'Require uninstall code' is enabled in the policy on the console, uninstall is possible.
• Sensors uninstalled via the Console will process the request after their next successful check-in.
• Sensors in Bypass due to an Error status (e.g. System ext. not approved) may first require remediation before an uninstall will complete successfully.