How to Remove EDR Sensors from a Decommissioned Server

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How to remove sensors when the server no longer exists from decommissioning or server hardware failure.

Environment

• EDR Sensors: All versions
• Microsoft Windows
• Linux
• macOS

Resolution

Windows

• EDR: Silently Uninstall Sensor on a Windows Machine
• GPO / SCCM
• For Tamper Enabled Sensors
  • EDR: Tamper Protection Password History is Currently Removed when the Group is Deleted

Linux

• EDR: How to Manually Uninstall a Linux Sensor

macOS

• EDR: How to Uninstall a MacOS Sensor

Additional Information

• Microsoft Anti Malware Protection Service is used to protect the sensor when Tamper Protection is enabled (for supporting OS's). If Postgres is not available to get the tamper protection password, the only way is to disable the protection service in safemode via the instructions given.