EDR: Console Sensor Uninstall Got Blocked by App Control Tamper Protection
search cancel

EDR: Console Sensor Uninstall Got Blocked by App Control Tamper Protection

book

Article ID: 289681

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Uninstalling sensors using the console got blocked by App Control tamper protection.

Environment

  • EDR: All versions
  • App Control: All versions
  • App Control:¬†Response Tamper Protection rapid config is enabled

Cause

uninst.exe is not signed.

Resolution

It's suggested to disable Response Tamper Protection rapid config on legit console uninstall.

Additional Information

  • Console upgrade is not affected as it doesn't call uninst.exe.