Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How to Stop/Start the Sensor via Command Line (Windows)

Carbon Black Cloud: How to Stop/Start the Sensor via Command Line (Windows)

Environment

  • Carbon Black Cloud Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions

Objective

How to completely stop/start the Carbon Black Cloud Sensor for testing purposes.

Resolution

Disable Sensor:
  1. Log into the machine with a user account that matches the AD User or Group SID configured for RepCLI authentication.
  2. Launch a Command Prompt.
  3. Change directory to C:\Program Files\Confer. 
    cd C:\Program Files\Confer
  4. Bypass must be enabled on the Sensor before services can be stopped.
    repcli bypass 1
    Sensor is in bypass mode
  5. Stop Sensor services.
    repcli stopcbservices
    Successfully sent command to stop the service via RepUtilStopService
    
Enable Sensor:
  1. From an administrative Command Prompt, execute the following commands.
    net start cbdefense
    The CB Defense service was started successfully.
    
  2. Change directory to C:\Program Files\Confer. 
    cd C:\Program Files\Confer
  3. Remove the Sensor from Bypass.
    repcli bypass 0
    Sensor is fully enabled

Additional Notes

  • Sensor Bypass can be toggled with RepCLI or through the Console while the services are running.
  • Sensor services cannot be started with the RepCLI utility, but can be started via services.msc or elevated Command Prompt (e.g. net start, sc start, etc.).

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
11730
Contributors