Carbon Black Cloud: How To Toggle Between System Extension and Kernel Extension on MacOS Big Sur

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

To toggle or switch between Kernel Extension and System Extension on MacOS Big Sur.

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 3.5.1.19
• Mac OS Big Sur (11)

Resolution

To toggle from System Extension to Kernel Extension

1. Confirm the Kernel Extension and System Extension are configured via MDM. See related content.
2. Run Command:

   sudo /Applications/VMware\ Carbon\ Black\
   Cloud/repcli.bundle/Contents/macOS/repcli setsensorkext <deregistration_code>

3. A window will appear stating that a System Extension has been updated. Approve this prompt in the Security & Privacy pane of System Preferences
4. Restart the OS

To toggle from Kernel Extension to System Extension

1. Confirm the Kernel Extension and System Extension are configured via MDM. See related content
2. Run Command:

   sudo /Applications/VMware\ Carbon\ Black\
   Cloud/repcli.bundle/Contents/macOS/repcli setsensorsysext <deregistration_code>

3. Restart the OS