EDR: Disabling Tamper Protection Fails With "Failed to request lifting of tamper protection"

[#1]

Environment

• EDR Server: 7.4 and Higher
• EDR Windows Sensor: 7.2 and Higher

Symptoms

When using CbEDRCLI.exe to disable tamper protection after entering the password the error "Failed to request lifting of tamper protection" is seen

Cause

This can happen if the password is wrong or tamper protection is disabled

Resolution

Use the correct password from the console

Additional Notes

• If the sensor has never communicated with the server then tamper protection will be disabled by default, even if the sensor group has tamper protection enabled
• The command to disable tamper protection is 

  C:\Windows\CarbonBlack\CbEDRCLI.exe <override_password>

Related Content

EDR: How do you get started with Tamper Protection?
EDR: How to uninstall a corrupt Cb Response sensor
EDR: Silently Uninstall Sensor on a Windows Machine