Can the Sensor Removal Tool (SRT) be run without Safe Mode?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Can the Sensor Removal Tool be run without first being run in Safe Mode?

Environment

• Carbon Black Cloud Sensor: 3.4 and above
• Microsoft Windows: All Supported Versions

Resolution

• Prior to 3.4.x Carbon Black Cloud sensor versions, Safe Mode was not required
• As of 3.4.x Carbon Black Cloud sensor versions, the sensor service runs as a protected service, so Safe Mode is required to successfully remove the protected services