Carbon Black Cloud: How to query the windows registry for the installed version of the CB Defense sensor

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• How to find out the installed version of the Carbon Black Cloud sensor on a Windows machine via the registry.

Environment

• Endpoint Standard Sensor (formerly CB Defense)
• Enterprise EDR Sensor
• Microsoft Windows: All Supported Versions

Resolution

• Using Powershell execute the following command :

  • Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Get-ItemProperty | Where-Object {$_.DisplayName -match "Cb Defense Sensor"} | Select-Object -Property DisplayVersion

• For newer sensors:

  • Get-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Get-ItemProperty | Where-Object {$_.DisplayName -match "Carbon Black"} | Select-Object -Property DisplayVersion

    
     
• This will display the following output, depending on version installed.
  • DisplayVersion
    --------------
    3.4.0.1016