Troubleshoot Sensor Uninstall Issues

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to Troubleshoot Sensor Uninstall Issues

Environment

• Carbon Black Cloud Sensor: All supported versions

Resolution

1. Please make sure the uninstall has been attempted via the following process per OS
   • Windows
     • If the uninstall is still failing the uninstall log will either be generated at %temp%\cb-installer-<version>.log or, if %temp% does not exist, %SystemRoot%\temp (typically C:\Windows\temp).
     • Next, search for "Return value" in the install logs, 0 or 1's normally are ok, 1603 is a default Windows failure.
     • These are code blocks, there will be a "Return Value" then a code block, and then another "Return Value". Review the data in the code block between the Return Values for the issue.
   • MacOS
   • Linux
2. If not resolved please open a case with CB Support, the case will start by collecting information:
   1. Is the uninstall code enabled for this policy/policies containing the impacted device(s)?
   2. What steps were taken to uninstall?
   3. How many devices are exhibiting this behavior?
   4. What is the device sensor version?
   5. What is the device operating system?
   6. What is the device name?
   7. Is the sensor being uninstalled using the console, command line, or GPO?
   8. Is the sensor being uninstalled using attended or unattended method?
   9. If it hasn't been attempted yet please run the uninstall from the command prompt following these instructions
   10. Please upload the uninstall log to the case and include the uninstall/deregistration code used if any

Additional Information

• If this issue cannot be solved with CB Support troubleshooting steps, it may need escalation to the CB Engineering team.  Escalation will require information collected in the steps above as well as some additional diagnostics:
  1. Backend and ORG name
  2. Sensor Version
  3. Operating System of the Device
  4. cb-installer-x-x-x log for impacted device
  5. tcpdump for impacted device
  6. Procmon for impacted device taken during uninstall attempt
  7. CB support log analysis