Carbon Black Cloud: Does the Sensor Support Installation in User-Context?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does the Sensor Support Installation in User-Context?

Environment

• Carbon Black Cloud Console: All Versions
  • Audit and Remediation (was CB LiveOps)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
  • Managed Detection (was CB ThreatSight)
• Carbon Black Cloud Windows Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

As Carbon Black does not perform any systematic testing or qualification of sensor installation in the User-Context, there is some risk if the sensor is deployed in User-Context and support may be limited

Additional Information

• As long as the Sensor is installed by an admin account, the sensor should technically still be able to install in User-Context or System-Context. 
• Even if the sensor is installed in User-Context, the installer will elevate to system when installing the service and drivers. 
• By default or at least using the instructions documented in https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-Install-Windows-Sensors-using-SCCM/ta-p/49061, SCCM will install the sensor in System-Context