EDR: How To Manually Enable and Disable The Sensor On A Windows Endpoint

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How To Manually Enable and Disable The Sensor On A Windows Endpoint

Environment

• EDR (formerly CB Response) Sensor: All Verisons
• Microsoft Windows: All Supported Versions

Resolution

1. Disable the sensor service and driver
   1. Open an Administrator Command Prompt on the endpoint 
   2. Run

net stop carbonblack
fltmc unload carbonblackk

2. Enable the sensor service and driver
   1. Open an Administrator Command Prompt
   2. Run

fltmc load carbonblackk 
net start carbonblack