Carbon Black Cloud: How to Enable/Disable Sensor Bypass Via Terminal (Mac)

[#1]

Environment

• Carbon Black Cloud Console
• Carbon Black Cloud Sensor: All Supported Versions
• Apple macOS: All Supported Versions

Objective

Provide steps to enable or disable bypass when connected to a Mac endpoint

Resolution

1. Connect/login to the endpoint
2. Launch terminal emulator
3. Run desired command

   Enable Bypass
   sudo /Applications/Confer.app/uninstall -b  <UNINSTALL_CODE>
   
   Disable Bypass
   sudo /Applications/Confer.app/uninstall -n  <UNINSTALL_CODE>

Additional Notes

• {UninstallCode} should be replaced with the Company Deregistration Code found under Endpoints > Sensor Options > Company Codes in the CBC Console
• Running the following provides additional help text

  sudo /Applications/Confer.app/uninstall -h

• Previous method

  Enable Bypass
  sudo /Applications/Confer.app/uninstall --bypass-enter {UninstallCode}
  
  Disable Bypass
  sudo /Applications/Confer.app/uninstall --bypass-exit {UninstallCode}

Related Content

CB Defense: How to Verify the Sensor is in Bypass mode locally (Mac)