Endpoint Standard: How to Verify the Sensor is in Bypass mode locally (Windows)

[#1]

Environment

• Endpoint Standard Sensor: 3.4.x version and below
• Microsoft Windows: All Supported Versions

Objective

• Provide steps to verify the current bypass status of the Windows Defense Sensor locally.

Resolution

1. Open an elevated command window on the endpoint to be checked.
2. Issue the following command

   reg query "HKLM\System\CurrentControlSet\Services\CbDefense"

3. Examine the output for the subkey "Passthru",
   1. If the subkey exists and it's value is at 0x1, the sensor is in bypass mode

Additional Notes

• If the sensor is not in Bypass, then Passthru REG_DWORD will not be displayed.
• For version 1 (1.0.6.196 and earlier), use the following command (Confer Sensor Service in place of CbDefense): reg query "HKLM\System\CurrentControlSet\Services\Confer Sensor Service"
• For version 3.5.x and above, use the Repcli method to verify the sensor bypass status by following Click Here

Related Content

Cb Defense: How To Enable and Disable Bypass Via Command Line (Windows)
Endpoint Standard: How to Verify Sensor Status With RepCLI