EDR: How to uninstall EDR Sensor from Windows endpoints with App Control Agent Installed

[#1]

Environment

• EDR Sensors: All Supported Versions
• App Control Agents: All Supported Versions
• Microsoft Windows: All Supported Versions

Objective

How to uninstall an EDR Sensor from Windows endpoints that also have an App Control Agent installed.

Resolution

Disable EDR Tamper Protection: (Globally)

1. Log in to the App Control Console and navigate to Rules > Software Rules > Rapid Configs.
2. Check the box for Carbon Black EDR Tamper Protection > Action > Disable Rapid Config.
3. Uninstall the EDR Sensor.

Disable EDR Tamper Protection: (Per Endpoint)

1. Log in to the endpoint and use a command prompt to issue the following commands:

   cd "C:\Program Files (x86)\Bit9\Parity Agent\"
   dascli password GlobalPassword
   dascli kernelconfig CarbonBlackTamperProtection 0

2. Uninstall the EDR Sensor

Related Content

EDR: How to uninstall a corrupt Cb Response sensor
EDR: Silently Uninstall Sensor on a Windows Machine
EDR: Will uninstalled sensor records stay in the UI forever?
EDR: Is it Possible to Prevent the Uninstall of the Sensor?
EDR: Installed sensor is showing as uninstalled
EDR: How to Bulk Uninstall Sensors
EDR: How to manually uninstall a sensor from a Linux endpoint