EDR: How to uninstall the CB Response sensor via command line (MSI Installation media only)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• How to uninstall the EDR sensor via command line.
• This is only applicable to EDR sensors which were installed with the the 'MSI' package and not the 'EXE' package.

Environment

• EDR Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Open an elevated command prompt.
2. Open regedit.exe
   • Navigate to the following registry hive to retrieve the 'MSIUninstallString'
     • HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack
3. Double click on the 'MSIUninstallString' and copy the value.
4. Paste the value in the elevated command prompt and press enter.

Additional Information

• Alternatively you can query the 'MSIUninstallString' via the same command prompt by executing the following command.
  • reg query "HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack" | findstr "MSIUninstallString"