EDR Sensor: How to reset sensor ID in Windows
search cancel

EDR Sensor: How to reset sensor ID in Windows

book

Article ID: 290588

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

  • Reset the Windows sensor ID.
  • This is typically done when a golden image was used after registration and multiple endpoints have the same ID

Environment

  • EDR Sensor: All Versions
  • Microsoft Windows: All Supported Versions

Resolution

  • 7.2.1 and Above
    1. Run Command Prompt as Administrator
    2. Execute
      • sc control carbonblack 210
  • 7.2.0 and Below
  1. Log into the endpoint as an admin user 
  2. From an admin command line, run: 
reg delete hklm\software\carbonblack\config /v SensorId
  1. Reboot the endpoint computer. 

Additional Information

Steps for 7.2.0 and below will work for later sensors as well if necessary.