Skip to main content
Go to Red Canary Documentation
Red Canary Support

How to Uninstall Carbon Black Cloud Sensors

  • Updated .

Issue

Instructions needed with available options for uninstalling the Carbon Black Cloud (CBC) sensor from each OS.

Environment

Carbon Black Cloud

Resolution

Before you get started, document your Company Deregistration Code, which can be used as a global passphrase to uninstall any lingering, uncommunicative, or corrupt sensors from your endpoints.  Your current code can found or generated under Inventory > Endpoints > Sensor Options > View Company Codes > Deregistration.

If migrating away from Carbon Black Cloud as your EDR vendor, it is recommended to disable Require code to uninstall sensor under each of your sensor policies to simplify removal of lingering sensors.  Failure to do so may result in complications uninstalling sensors after access to the CBC console has been revoked.

The following links are specific to Carbon Black Cloud (CBC) only.  For uninstall guidance specific to Carbon Black EDR (formerly CB Response), see How to Uninstall Carbon Black EDR Sensors.

Windows

  1. Uninstall from the Carbon Black Cloud console (preferred)
  2. Uninstall Windows Sensors via Group Policy
  3. Uninstall Windows Sensors via SCCM
  4. Uninstall Windows Sensor from the Local Machine
  5. Uninstall a Corrupt Windows Sensor (last resort)

macOS

  1. Uninstall from the Carbon Black Cloud console (preferred)
  2. Uninstall macOS Sensor via Terminal
  3. Uninstall macOS Sensor using Removal Tool
  4. Uninstall a Corrupt macOS Sensor (last resort)

Linux

  1. Uninstall Linux Sensor via Terminal

Cause

Only Windows and macOS sensors can be uninstalled from the Carbon Black Cloud console, while Linux requires a command line uninstall.  Any command line uninstall methods provided in these links can be used in scripts and pushed to endpoints using your preferred software deployment utility.

Click here to learn more about endpoint threat protection with Red Canary