Methods to Uninstall the Carbon Black Cloud Windows Sensor

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide a list of options to uninstall the Carbon Black Cloud sensor from a Windows endpoint.

Environment

• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

Method 1: Via The Console

This uninstall method happens silently with no interaction required by the end-user

1. Log into the Carbon Black Cloud Dashboard.
2. Click on the Inventory > Endpoints option on the side-panel.
3. Check the box next to each sensor you want to uninstall.
4. Select Take Action > Uninstall
5. Confirm the action by selecting Uninstall in the pop-up

Method 2: Via Programs and Features

Note: In version 4.2 and above, if the Policy option for 'Require code to uninstall sensor' is enabled, you will be prompted for the uninstall password. In version 4.1 and below, if the Policy option for 'Require code to uninstall sensor' is enabled, then sensors cannot be uninstalled using this method.

1. Using an account with Administrator privileges, go to Control Panel > Programs and Features
2. Select Carbon Black Cloud Sensor
3. Click Uninstall
4. Refresh Programs and Features to verify the sensor has been removed

Method 3: Via Command Prompt

Version 4.2+

1. Open an administrative command prompt
2. Navigate to the bin64 directory

   cd C:\Program Files\Broadcom\Endpoint Security Agent\CurrentVersion\bin64\

3. Run one of the following commands, depending on the 'Require code to uninstall sensor' policy setting:
   • Require Code Enabled

     seasetup.exe --uninstall --product cbc --quiet --password XXXXXXXX
     

   • Require Code Disabled

     seasetup.exe --uninstall --product cbc --quiet

Version 4.1 and below:

This method requires either the uninstall code or deregistration code. 

1. Open an administrative command prompt. 
2. Navigate to the Confer directory:

   CD %ProgramFiles%\Confer

3. Run one of the following commands, depending on the 'Require code to uninstall sensor' policy setting
   • Require Code Enabled:

     uninstall.exe /uninstall EnterUninstallCodeHere

   • Require Code Disabled:

     uninstall.exe /uninstall

Method 4: Via Safe Mode

If the uninstall code is unknown, or the device never received one from the backend (never checked in), the below steps can be utilized.

1. Boot the device into safe mode
2. Open a text editor (such as Notepad) as Administrator
3. Open the cfg.ini file
   • 4.2 and above::
     • %programdata%\Broadcom\Endpoint Security Agent\sef\plugins\cbc\DataFiles\cfg.ini
   • 3.6 and below:
     • %programdata%\CarbonBlack\DataFiles
   • 3.6 and below:
     • C:\Program Files\Confer
4. Locate the following line:

   RequireUninstallCode=true

5. Edit the line to read::

   RequireUninstallCode=false

6. Save the file and reboot the machine to normal mode.
7. Proceed to uninstall the sensor using either Method 2 or Method 3.

Method 5: Via CleanWipe or Sensor Removal Tool

WARNING:

• Use as a Last Resort: Broadcom Support advises against using CleanWipe or the Sensor Removal Tool as your initial uninstallation method. Only use these utilities if methods 1-4 are unsuccessful.

Carbon Black Cloud 4.2+:

See Download and Run CleanWipe To Uninstall Symantec and Carbon Black Products

Carbon Black Cloud 4.1 and below:

1. Download and extract  "SensorRemovalTool.zip" (attached to this article).
2. Copy the appropriate .exe to a directory local to the affected endpoint (such as c:\temp)

   Operating System	Sensor Version
   x64 (64-bit)	4.1 and below
   ARM64 (64-bit)	4.1 and below
   x86 (32-bit)	4.0.3 and below (A x64 sensor does not exist in 4.1)

3. Boot into Safe Mode
4. Open an administrative command prompt. 
5. Change directory to the unzipped location in step 2

   cd c:\temp

6. Run the check command:

   SensorRemovalTool.exe /check > C:\temp\%COMPUTERNAME%_Check_CBC_Diagnostics.txt

7. Run the cleanup command (replacing EnterUninstallCodeHere with your actual code):

   SensorRemovalTool.exe /cleanup EnterUninstallCodeHere >> C:\temp\%COMPUTERNAME%_Safe_CBC_Diagnostics.txt

8. Boot into Normal mode as the same user and run this tool again to complete removal of the sensor

   SensorRemovalTool.exe /cleanup EnterUninstallCodeHere > C:\temp\%COMPUTERNAME%_Normal_CBC_Diagnostics.txt

9. Reboot one final time to complete sensor removal
10. If the issue still persists, collect the output files (Check_CBC_Diagnostics.txt, Safe_CBC_Diagnostics.txt, and Normal_CBC_Diagnostics.txt) and contact Technical Support.

Additional Information

The uninstallation will be logged to a file named ‘cb-installer-<version>.log' in one of the directories below (depending on sensor version / OS):

• C:\Users\<user>\AppData\Local\Temp\
• C:\Windows\TEMP\
• C:\Users\All Users\AppData\Local\Temp