EDR: How to Collect Windows Sensor Diagnostic Logs With Tamper Protection enabled (7.2.0+)

[#1]

Environment

• EDR Sensors: 7.2.0 and Higher
• Microsoft Windows: All Supported Versions
• Microsoft .NET 4.5 and Higher

Objective

How to collect diagnostics using the sensordiags.exe tool for sensors in a sensor group with Tamper Protection enabled.

Resolution

There are two methods to do this:

1. Via CB Live Response:
   1. Establish a CB Live Response session and enter (replace <username> with your username):

   2. execfg cmd.exe /c sensordiag -type CDE -output c:\users\<username>\desktop\

   3. Collect the zip file from c:\users\<username>\desktop.
2. Locally on the endpoint:
   1. Open an elevated command prompt.
   2. Copy sensordiag.exe to a writable and executable path (replace <username> with your username):

   3. copy c:\windows\carbonblack\sensordiag.exe c:\users\<username>\desktop\

   4. Execute sensordiag.exe:

   5. c:\users\<username>\desktop\sensordiag.exe -type CDE -output c:\users\<username>\desktop\

   6. Collect the zip file from c:\users\<username>\desktop.

Related Content

• EDR: How to Collect Windows Sensor Diagnostic Logs (6.2.2+)
• CB Response: How to Collect Windows Sensor Diagnostic Logs (6.2.1 and below)