CB Defense: How to Confirm Sensor is Running as a Protected Service

[#1]

Environment

• CB Defense PSC Sensor: 3.4.0.1016 and higher
• Microsoft Windows: Windows 10 1703 and higher

Objective

Confirm if Sensor service is running as a protected service (protected by Windows)

Resolution

1. Open a command prompt
2. Run the "sc qprotection" command to confirm Sensor service status

   sc qprotection cbdefense

3. The results will show the service protection level

   SERVICE cbdefense PROTECTION LEVEL: ANTIMALWARE LIGHT.

Additional Notes

The "sc qprotection" command can also be run against the CbDefenseWSC service

Related Content

Carbon Black Cloud: How to Collect ProcMons and ProcDumps on 3.4 and Higher Sensor