Carbon Black Cloud: Does the Sensor Support Installation in User-Context?
book
Article ID: 290060
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Does the Sensor Support Installation in User-Context?
Environment
Carbon Black Cloud Console: All Versions
Audit and Remediation (was CB LiveOps)
Endpoint Standard (was CB Defense)
Enterprise EDR (was CB ThreatHunter)
Managed Detection (was CB ThreatSight)
Carbon Black Cloud Windows Sensor: All Supported Versions
Microsoft Windows: All Supported Versions
Resolution
As Carbon Black does not perform any systematic testing or qualification of sensor installation in the User-Context, there is some risk if the sensor is deployed in User-Context and support may be limited
Additional Information
As long as the Sensor is installed by an admin account, the sensor should technically still be able to install in User-Context or System-Context.
Even if the sensor is installed in User-Context, the installer will elevate to system when installing the service and drivers.
By default or at least using the instructions documented in https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-Install-Windows-Sensors-using-SCCM/ta-p/49061, SCCM will install the sensor in System-Context