CB Defense: How to enable live response memory dump registry key in MST file

[#1]

Environment

• CB Defense Sensor: 3.3.X and Higher

Objective

• How to enable the memory dump capability via live response for the 3.3.X sensor and above via MST file.
• This method will allow the registry key to be created automatically upon installation, without the need of manual intervention as documented in the following KB : Endpoint Standard: How to Turn On Live Response Memory Dump Capability in Sensor Version 3.3.x and 3...

Resolution

• Refer to the PSC-Sensor-Installation-guide (Page 12) - Unattended Windows sensor install by using Group Policy : https://community.carbonblack.com/t5/Documentation-Downloads/PSC-Sensor-Installation-Guide/ta-p/5215

1. Once you have configured all your additional items under the 'Property' table (step 10), navigate to the 'Registry' table, under 'Tables'.
2. Select the empty row under the last 'Registry Entry' --> right click --> Add Row.
3. This will open a 'Add Row' window. Add the following 'Value' information as follows;

Name	Value
Registry	regLiveMemDump
Root	2
Key	SYSTEM\CurrentControlSet\Services\ctifile
Name	InitializePhysicalMemoryDump
Value	#1
Component	ConferBaseDirComponent

4. Proceed to step 12.) of the installation guide.

Additional Notes

• Before deploying to to multiple sensors, please test on one machine and ensure the registry key has been created successfully.
• To check to see if the registry key has been created execute the following command via elevated cmd prompt;
  • reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctifile | find "InitializePhysicalMemoryDump"

Output

• InitializePhysicalMemoryDump    REG_DWORD    0x1

Related Content

• Endpoint Standard: How to Turn On Live Response Memory Dump Capability in Sensor Version 3.3.x and 3...
• https://community.carbonblack.com/t5/Documentation-Downloads/PSC-Sensor-Installation-Guide/ta-p/5215...