Carbon Black Cloud: How to prevent end user from stopping the Enterprise EDR Sensor on macOS

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Prevent end users from disabling the EEDDR Sensor on macOS endpoints via Settings > Login Items 

Environment

• Endpoint Standard Sensor: All Supported Versions
• Endpoint Standard Sensor UI 

Resolution

A custom configuration profile needs to be created through Apple Configuration 2 to restrict users from disabling the Sensor. The basic format of the configuration provided below can be used.
 

<key>RuleType</key> 
<string>TeamIdentifier</string>
 <key>RuleValue</key> 
<string>7AGZNQ2S2T</string>

Additional Information

The string value "7AGZNQ2S2T" is the Team ID for the Carbon Black Cloud software.