EDR: Enable Verbose Debug Logging Remotely on Windows Sensor

[#1]

Environment

• EDR Sensor: All Versions
• EDR Console: All Versions
• Microsoft Windows: All Supported Versions

Objective

• How to enable verbose user and kernel-mode logging remotely via CB Live Reponse.

Resolution

1. Back up the registry prior to enabling logging
2. Remotely enable verbose logging:
   • Establish a CB Live Response session with the endpoint
   • Enter the following two commands within CB Live Response:

reg add HKLM\Software\CarbonBlack\config -v DebugLevel -t REG_DWORD -d 7
reg add HKLM\Software\CarbonBlack\config -v KernelDebugLevel -t REG_DWORD -d 7

• The registry setting will not take affect until the user-mode sensor service is restarted

execfg cmd.exe /K "sc control carbonblack 203"

3. Reproduce the issue
4. Collect logs: 

• https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostic-Log...
• https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostics-Lo...

3. Disable verbose logging in Live Response

   • reg delete HKLM\Software\CarbonBlack\config /v DebugLevel /f
     reg delete HKLM\Software\CarbonBlack\config /v KernelDebugLevel /f
     execfg cmd.exe /K "sc control carbonblack 203"

4. Upload the diagnostics to the CB Vault

Related Content

EDR: Enable verbose logging locally on Windows sensor
How to back up and restore the registry in Windows - Microsoft SupportCalifornia Consumer Privacy Ac...