EDR: How To Restart the EDR Sensor on Windows
search cancel

EDR: How To Restart the EDR Sensor on Windows

book

Article ID: 289970

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to restart EDR Sensor on MS Windows OS.

Environment

  • EDR Sensor: All Versions
  • Microsoft Windows: All Supported Versions

Resolution

  1. Open command line window as Administrator (right-mouse-> Run as Administrator)
  2. Run following commands to stop the sensor services: 
net stop carbonblack 

7.2.0 and Above:
fltmc unload carbonblackk

7.1.x and Below: 
net stop carbonblackk
  1. Run following commands to confirm both services are stopped: 
sc.exe query carbonblack 
sc.exe query carbonblackk
  1. Run following commands to start services: 
net start carbonblack 

7.2.0 and Above:
fltmc load carbonblackk

7.1.x and Below:
net start carbonblackk 
  1. (Optional) Following command will force the sensor to perform 'checkin' with the EDR Server:
sc.exe control carbonblack 200