CB Response: Custom sensor process name will not set

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor showing up with the default cb.exe process name in Task Manager and process lists
• sensorsettings.ini lists the sensor_exe_name as the custom name
• A sensor crash may have occurred after installation

Environment

• CB Response Server: 6.1 and Higher
• Linux: All Supported Versions
• CB Response Sensor: 6.x
• Microsoft Windows: All Supported Versions

Cause

• This is a known issue caused by how we check what the process name is set to - CB-22642

Resolution

1. Stop the sensor services

   sc stop carbonblack
   sc stop carbonblackk

2. Change or add the desired server name under HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\config\CbExeName
   1. Run cmd as administrator
   2. Substitute <sensor_process_name> with the desired process name

      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\config /v CbExeName /d <sensor_process_name>
      

   3. If the CbExeName already exists, overwrite the current value by typing 'Yes'
3. Start sensor services

   sc start carbonblack