Carbon Black Cloud: How to Enable/Disable Sensor Bypass Via Terminal (Mac)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide steps to enable or disable bypass when connected to a Mac endpoint

Environment

• Carbon Black Cloud Console
• Carbon Black Cloud Sensor: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

1. Connect/login to the endpoint
2. Launch terminal emulator
3. Run desired command

   Enable Bypass
   sudo /Applications/Confer.app/uninstall -b  <UNINSTALL_CODE>
   
   Disable Bypass
   sudo /Applications/Confer.app/uninstall -n  <UNINSTALL_CODE>

Additional Information

• {UninstallCode} should be replaced with the Company Deregistration Code found under Endpoints > Sensor Options > Company Codes in the CBC Console
• Running the following provides additional help text

  sudo /Applications/Confer.app/uninstall -h

• Previous method

  Enable Bypass
  sudo /Applications/Confer.app/uninstall --bypass-enter {UninstallCode}
  
  Disable Bypass
  sudo /Applications/Confer.app/uninstall --bypass-exit {UninstallCode}