How to Remove EDR Sensors from a Decommissioned Server
search cancel

How to Remove EDR Sensors from a Decommissioned Server

book

Article ID: 291110

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How to remove sensors when the server no longer exists from decommissioning or server hardware failure.

Environment

  • EDR Sensors: All versions
  • Microsoft Windows
  • Linux
  • macOS

Resolution

Additional Information

  • Microsoft Anti Malware Protection Service is used to protect the sensor when Tamper Protection is enabled (for supporting OS's). If Postgres is not available to get the tamper protection password, the only way is to disable the protection service in safemode via the instructions given.