EDR: Enable verbose logging locally on Windows sensor

[#1]

Environment

• EDR Sensor: Version 5.x and above (Formerly CB Response)
• EDR Console: Version 5.x and above
• Microsoft Windows: All Supported Versions

Objective

• How to enable verbose user and kernel-mode logging locally via Command prompt.

Resolution

1. Back up the registry prior to enabling logging
2. Locally enable verbose logging:
   • Open a command prompt as administrator
   • Enter the following two commands:

     • reg add HKLM\Software\CarbonBlack\config /v DebugLevel /t REG_DWORD /d 7
       reg add HKLM\Software\CarbonBlack\config /v KernelDebugLevel /t REG_DWORD /d 7
       

   • The registry setting will not take affect until the user-mode sensor service is requested to update:

     • sc control carbonblack 203

3. Reproduce the issue
4. Collect logs: 
   • https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostic-Log...
   • https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostics-Lo...
5. Disable debug logging from the command prompt

   • reg delete HKLM\Software\CarbonBlack\config /v DebugLevel /f
     reg delete HKLM\Software\CarbonBlack\config /v KernelDebugLevel /f
     sc control carbonblack 203

6. Upload the diagnostics to the CB Vault

Related Content

EDR: Enable Verbose Logging remotely on Windows sensor
https://support.microsoft.com/en-us/help/322756/how-to-back-up-and-restore-the-registry-in-windows