Methods to Uninstall the Carbon Black Cloud Windows Sensor

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide a list of options to uninstall the Carbon Black Cloud sensor from a Windows endpoint

Environment

• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

Method 1: Via The Console

This uninstall method happens silently with no interaction required by the user

1. Log into the Carbon Black Cloud Dashboard
2. Click on the Inventory - Endpoints option on the side-panel
3. Within the endpoints page, select the checkbox next to all sensors to be uninstalled
4. Select Take Action > Uninstall
5. Confirm the action by selecting Uninstall in the pop-up
6. Confirm the sensor has been uninstalled. This may take a few minutes until the next scheduled check-in for the sensor

Method 2: Via Programs and Features (Add/Remove Programs)

If the Policy option for 'Require code to uninstall sensor' is enabled, then sensors cannot be uninstalled using this method. 

1. Using an account with Administrator privileges, go to Control Panel > Programs and Features
2. Select Carbon Black Cloud Sensor
3. Click Uninstall
4. Refresh Programs and Features to verify the sensor has been removed
5. Verify in the Carbon Black Cloud Console that the device has been moved to de-registered status

Method 3: Via Command Prompt

This method requires either the uninstall code or deregistration code. 

1. Open an administrative command prompt. 
2. Navigate to the Confer directory:

   CD %ProgramFiles%\Confer

3. Run one of the following commands, depending on the 'Require code to uninstall sensor' policy setting
   • Uninstall Code Enabled:

     uninstall.exe /uninstall <code>

   • Uninstall Code Disabled:

     uninstall.exe /uninstall

Method 4: Via Safe Mode/ Disabling 'Require code to uninstall sensor'

If the uninstall code is unknown, or the device never received one from the backend (never checked in), the below steps can be utilized.

1. Boot the device into safe mode
2. Open a text editor such as Notepad as administrator
3. Open the cfg.ini file (C:\Program Files\ConferStarting or %programdata%\CarbonBlack\DataFiles)
4. Edit the line:

   RequireUninstallCode=true

5. Replace it with:

   RequireUninstallCode=false

6. Save the change
7. Boot Machine normally
8. Uninstall via method 2 or 3

Additional Information

The uninstallation will be logged to a file named ‘cb-installer-<version>.log' in one of the directories below (depending on sensor version / OS):

• C:\Users\<user>\AppData\Local\Temp\
• C:\Windows\TEMP\
• C:\Users\All Users\AppData\Local\Temp