EDR: Disabling Tamper Protection Fails With "Failed to request lifting of tamper protection"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When using CbEDRCLI.exe to disable tamper protection after entering the password the error "Failed to request lifting of tamper protection" is seen

Environment

• EDR Server: 7.4 and Higher
• EDR Windows Sensor: 7.2 and Higher

Cause

This can happen if the password is wrong or tamper protection is disabled

Resolution

Use the correct password from the console

Additional Information

• If the sensor has never communicated with the server then tamper protection will be disabled by default, even if the sensor group has tamper protection enabled
• The command to disable tamper protection is 

  C:\Windows\CarbonBlack\CbEDRCLI.exe <override_password>

• In recent versions the command has changed
  

  C:\Windows\CarbonBlack\CbEDRCLI.exe -tamper <override_password>

• The tamper protection will be disabled for an hour and then it will re-enable again Use the Tamper Protection CLI Tool