EDR: How To Manually Enable and Disable The Sensor On A Windows Endpoint

[#1]

Environment

• EDR (formerly CB Response) Sensor: All Verisons
• Microsoft Windows: All Supported Versions

Objective

How To Manually Enable and Disable The Sensor On A Windows Endpoint

Resolution

1. Disable the sensor service and driver
   1. Open an Administrator Command Prompt on the endpoint 
   2. Run

net stop carbonblack
fltmc unload carbonblackk

2. Enable the sensor service and driver
   1. Open an Administrator Command Prompt
   2. Run

fltmc load carbonblackk 
net start carbonblack