Carbon Black Cloud: Does the Sensor Support Installation in User-Context?
search cancel

Carbon Black Cloud: Does the Sensor Support Installation in User-Context?

book

Article ID: 290060

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does the Sensor Support Installation in User-Context?

Environment

  • Carbon Black Cloud Console: All Versions
    • Audit and Remediation (was CB LiveOps)
    • Endpoint Standard (was CB Defense)
    • Enterprise EDR (was CB ThreatHunter)
    • Managed Detection (was CB ThreatSight)
  • Carbon Black Cloud Windows Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions

Resolution

As Carbon Black does not perform any systematic testing or qualification of sensor installation in the User-Context, there is some risk if the sensor is deployed in User-Context and support may be limited

Additional Information

  • As long as the Sensor is installed by an admin account, the sensor should technically still be able to install in User-Context or System-Context. 
  • Even if the sensor is installed in User-Context, the installer will elevate to system when installing the service and drivers. 
  • By default or at least using the instructions documented in https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-Install-Windows-Sensors-using-SCCM/ta-p/49061, SCCM will install the sensor in System-Context