EDR: Console Sensor Uninstall Got Blocked by App Control Tamper Protection

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Uninstalling sensors using the console got blocked by App Control tamper protection.

Environment

• EDR: All versions
• App Control: All versions
• App Control: Response Tamper Protection rapid config is enabled

Cause

uninst.exe is not signed.

Resolution

It's suggested to disable Response Tamper Protection rapid config on legit console uninstall.

Additional Information

• Console upgrade is not affected as it doesn't call uninst.exe.