EDR: Console Sensor Uninstall Got Blocked by App Control Tamper Protection
book
Article ID: 289681
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Uninstalling sensors using the console got blocked by App Control tamper protection.
Environment
- EDR: All versions
- App Control: All versions
- App Control: Response Tamper Protection rapid config is enabled
Cause
uninst.exe is not signed.
Resolution
It's suggested to disable Response Tamper Protection rapid config on legit console uninstall.
Additional Information
- Console upgrade is not affected as it doesn't call uninst.exe.
Feedback
thumb_up
Yes
thumb_down
No