Automate cleanup of CB Defense sensor after a failed uninstall using SCCM

CarbonBlack recently released version 3.1 of the 'sensor' for their CB Defense product.  This sensor is the client side agent installed on each PC.  The CB Defense sensor does not self update, but installing the new version should be as simple as a few clicks in the CB Defense web console or downloading the install package and deploying it using your favorite method.  Unfortunately, it's not always so simple.

In many cases, when the installer attempts to remove the old version of the sensor during the upgrade process, the uninstall does not completely remove the old sensor, and installation of the new sensor fails.  This leaves the computer with no working version of the CB Defense sensor installed.  The old version of the sensor no longer shows up under "Programs and Features", and all attempts to install the new version fail. 

The CarbonBlack User Exchange (login required) site has a few articles describing this issue and potential workarounds.   An article CB Defense: Uninstall the Windows Sensor even includes a link to download the handy Sensor Removal Tool, perfect for just this situation.  The sensor removal tool is designed to remove any bits and pieces of the sensor left behind after a failed uninstall.  Simply extract the appropriate exe from the zip file and run it with the /cleanup parameter, and it will take care of the rest!  Of course, that only fixes the computer you run it on.  What if you deployed the new sensor version out to many or all of your clients, and now need to perform this cleanup on hundreds of computers?

This is where System Center Configuration Manger (SCCM) steps in to save the day.  Download SensorRemovalTool.zip and extract the contents.  Select Sensor21RemovalToolx64.exe (or Sensor21RemovalToolx86.exe if you're still running a 32-bit OS), and copy it to a network share where you store your source files for SCCM apps and packages. 

In the Software Library workspace of the SCCM console, select Packages in the left pane, and then click the "Create Package" button on the toolbar. 















In the Create Package and Program wizard, enter a name and description for your package.  Check the box next to "This package contains source files, and use the Browse button to enter the UNC path to the network share where you saved the sensor removal tool exe file. 



On the Program Type screen, accept the default of "Standard Package" and click next. Next you'll fill in details about the Standard program.  Enter a name which makes sense to you.  In the "Command Line field, enter:   
      Sensor21RemovalToolx64.exe /Cleanup

 
 
Click Next through the remaining screens to accept the defaults and create the package.  Once the package is created, you're ready to distribute the content and deploy the package to a collection of computers.  Give the deployment time to run, removing the sensor from all computers in the collection, then re-deploy the CB Defense 3.1 sensor install to the collection.  All computers in the collection should now be able to install the new sensor successfully. 


Comments

Post a Comment

Popular posts from this blog

Mystery Solved: Bitlocker is enabled, but Intune shows the computer as non-compliant for Require Bitlocker

For some time, I have struggled to understand why Intune reports some computers as non-compliant with the "Require Bitlocker" setting, even though Bitlocker is enabled and working on the computer.  In my searches for an explanation, I found the same question asked by many others, but never an answer.  Until today. I accidentally stumbled across this article from Microsoft's Rob Lane , which explains how the Require Bitlocker setting is evaluated and why it might seem to incorrectly report a non-compliant state.  I encourage you to check out that article for full details.  I'll just summarize here the part that suddenly made this bitlocker compliance issue make sense to me. The "Require Bitlocker" setting in Intune relies on the Device Health Attestation (DHA) service in Windows 10 to report the state of Bitlocker encryption on the computer.  If Bitlocker protection is disabled or suspended, DHA will report that the computer is non-compliant with this ...
Read more

Windows 10 Credential Guard breaks WiFi

Recently, I ran into an issue with computers running windows 10 that would not connect to our WPA2-Enterprise encrypted wifi network.  When it failed to connect, there was no indication of why, only the message "Can't connect to this network."  The computers were able to connect to unencrypted networks and networks using a Pre-shared key for WPA encryption without issue. Checking the event logs on the RADIUS server to see why the comptuer failed to connect, there was no log entry for a connection attempt from the affected system.  The WLAN-Auto-Config log on the client listed a couple of errors, including Event ID 11006 and 12013, but other than showing that the failure reason was "Explicit EAP failure received", they didn't give much to go on: Log Name:      Microsoft-Windows-WLAN-AutoConfig/Operational Source:        Microsoft-Windows-WLAN-AutoConfig Date:          8/15/2016 1:11:20 PM Event ID:   ...
Read more

Data Sharing Service crashes on Windows Server 2016 - Event ID 7023

Image
While troubleshooting an issue recently on a Windows Server 2016 system, I noticed errors on the System event log about the Data Sharing Service crashing. The Data Sharing Service service terminated with the following error: %%3239247874 Searching online for more information about this service and why it might be failing, I came across a lot of people describing similar problems, but the only explanation and solution I found came from this December  blog post by Microsoft Japan .    Google translate did a great job making the post understandable to me, but since the information doesn't seem to have been widely publicized I thought I'd share it here to help get the word out. The Data Sharing Service fails due to a resource conflict with another service included in Server 2016, the User Access Logging Service.  Either one of these services alone will run without issue, but if one is already running and you try to start the other, it will fail. According to...
Read more