Environment
- EDR (formerly CB Response) Sensor: All Supported Versions
- Microsoft Windows: All Supported Versions
Objective
How to uninstall an EDR sensor silently via command line when it was originally installed using the Windows MSI for GPO Installation package.
Resolution
- Retrieve the Identifying number of the Sensor by using the following 2 steps
- Run the following cmd in powershell
- Get-WmiObject -Class Win32_Product | Where-Object -FilterScript {$_.Name -Like "CarbonBlack Sensor"} | Format-Table Name, IdentifyingNumber
OR
- Get-WmiObject -Class Win32_Product | Where-Object -FilterScript {$_.Name -Like "VMware Carbon Black EDR Sensor"}
- This will return the Identifying number e.g.
- Name IdentifyingNumber
---- -----------------
CarbonBlack Sensor {60F5B90A-1D6E-43CF-933F-5E5CFDCAD53C}
- Copy the Identifying number including the curly brackets
- Open elevated cmd prompt and execute the following silent uninstallation
- MsiExec.exe /qn /x{60F5B90A-1D6E-43CF-933F-5E5CFDCAD53C}
Related Content
