EDR Sensor: How to reset sensor ID in Windows

[#1]

Environment

• EDR Sensor: All Versions
• Microsoft Windows: All Supported Versions

Objective

• Reset the Windows sensor ID.
• This is typically done when a golden image was used after registration and multiple endpoints have the same ID

Resolution

• 7.2.1 and Above
  1. Run Command Prompt as Administrator
  2. Execute

     • sc control carbonblack 210

• 7.2.0 and Below

1. Log into the endpoint as an admin user 
2. From an admin command line, run: 

reg delete hklm\software\carbonblack\config /v SensorId

3. Reboot the endpoint computer. 

Additional Notes

Steps for 7.2.0 and below will work for later sensors as well if necessary. 

Related Content

EDR: Multiple endpoints checking in with the same sensor ID