Carbon Black Cloud: How to prevent end user from stopping the Enterprise EDR Sensor on macOS
book
Article ID: 289873
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Prevent end users from disabling the EEDDR Sensor on macOS endpoints via Settings > Login Items
Environment
Endpoint Standard Sensor: All Supported Versions
Endpoint Standard Sensor UI
Resolution
A custom configuration profile needs to be created through Apple Configuration 2 to restrict users from disabling the Sensor. The basic format of the configuration provided below can be used.