EDR Sensor: How to reset sensor ID in Windows

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

• Reset the Windows sensor ID.
• This is typically done when a golden image was used after registration and multiple endpoints have the same ID

Environment

• EDR Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

• 7.2.1 and Above
  1. Run Command Prompt as Administrator
  2. Execute

     • sc control carbonblack 210

• 7.2.0 and Below

1. Log into the endpoint as an admin user 
2. From an admin command line, run: 

reg delete hklm\software\carbonblack\config /v SensorId

3. Reboot the endpoint computer. 

Additional Information

Steps for 7.2.0 and below will work for later sensors as well if necessary.