Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How to Toggle Sensor Bypass with the RepCLI Utility (Windows)

Carbon Black Cloud: How to Toggle Sensor Bypass with the RepCLI Utility (Windows)

Environment

  • Carbon Black Cloud Sensor: 3.3.x.x and Higher
  • Microsoft Windows: All Supported Versions

Objective

Enable and disable Bypass Mode locally on the Sensor

Resolution

  1. Log into the machine with a user account that matches the AD User or Group SID configured at the time of sensor install
  2. Launch a Command Prompt
  3. Change directory to C:\Program Files\Confer
    cd C:\Program Files\Confer
    
  4. Enter the following command to enable Bypass
    repcli bypass 1
    
    --If the command is successful, 'Sensor is in bypass mode' will print to the command line
  5. Enter the following command to verify if Sensor is in Bypass mode. Scroll through the results to verify the "Sensor State" value. (Sensor State will be [Disabled] in Bypass Mode, [Enabled] if not.)
    repcli status
    
  6. Enter the following command to disable Bypass
    repcli bypass 0
    
    --If the command is successful, 'Sensor is fully enabled'; will print to the command line

Additional Notes

  • Active Directory-based SID authentication is required to run the "repcli bypass 1|0" commands
  • If Bypass is enabled on the sensor locally, Bypass can still be disabled from the Console if the Sensor is connected

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-27-2018
Views:
11180
Contributors