EDR: How To Restart the EDR Sensor on Windows

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to restart EDR Sensor on MS Windows OS.

Environment

• EDR Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Open command line window as Administrator (right-mouse-> Run as Administrator)
2. Run following commands to stop the sensor services: 

net stop carbonblack 

7.2.0 and Above:
fltmc unload carbonblackk

7.1.x and Below: 
net stop carbonblackk

3. Run following commands to confirm both services are stopped: 

sc.exe query carbonblack 
sc.exe query carbonblackk

4. Run following commands to start services: 

net start carbonblack 

7.2.0 and Above:
fltmc load carbonblackk

7.1.x and Below:
net start carbonblackk 

5. (Optional) Following command will force the sensor to perform 'checkin' with the EDR Server:

sc.exe control carbonblack 200