IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Cb Defense: PSC Console Uninstall Failing For Sensor 3.2.x+

Cb Defense: PSC Console Uninstall Failing For Sensor 3.2.x+

Environment

  • Cb Defense PSC Console: August '18 build and higher (0.39.x+)
  • Cb Defense Sensor: 3.2.x+
  • Microsoft Windows: All Supported Versions
  • Apple macOS: All Supported Versions
  • Uninstall/deregistration sent from Web Console

Symptoms

  • Sensor shows as Deregistered on Endpoints page
  • New Event data for Sensor still showing on Investigate and Alerts pages
  • Sensor still installed and running on endpoint
  • Sensor eventually uninstalls within ~24 hours

Cause

Uninstall/deregistration signal not being received correctly by Sensor

Resolution

This will be fixed in a future version of the PSC Console and Sensor.

Additional Notes

  • The fix for this issue will be documented in a future version of the Release Notes, with DSER-10342 and DSEN-3752 noted
  • The sensor typically will receive the uninstall hint in a delayed manner, but this can take roughly 24 hours
  • A workaround has been identified to get the uninstall to occur more quickly

Workaround

  1. Log into Cb Defense Web Console
  2. Go to Endpoints
  3. Find desired Device Name and check the box on the far-left
  4. Click Take Action > Change Policy
  5. Select desired Policy from drop-down
  6. Click Change

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-24-2018
Views:
444