Uninstall Carbon Black Response

Usage and Config
1

Hello. I created a custom fixlet to uninstall Carbon Black Response and have not been successful. I’ve tried every permutation and it looks like the fixlets runs, but the Carbon Black folder and everything in it, is still there. Hoping someone can see something I’m missing.

Here is what I’ve tried:
C:\windows\CarbonBlack\uninst.exe - (location of the uninstaller)

waithidden cmd.exe /c “C:\windows\CarbonBlack\uninst.exe /s”

waithidden cmd.exe /c “C:\Windows\CarbonBlack” & uninst.exe /s"

MsiExec.exe /X{{D42B4556-1408-4398-92F7-A2CB162AF048}

waithidden cmd.exe /c “cd “C:\Windows\CarbonBlack” & uninst.exe /s”

waithidden cmd.exe /c "cd “C:” & “%WINDIR%\CarbonBlack\uninst.exe /S”

2

64-bit redirection would be my first thought.

Do you have action uses wow64 redirection {not x64 of operating system} in your script?

Also, there was a recent thread on uninstalling Carbon Black - search the forum

3

Does the product have tamper protection and is it enabled for the systems you’re tryin gto remove it from? That could prevent the uninstall from being successful. I know other Carbon Black products such as Cb App Control have tamper protection.

4

I’ll try that wow64 redirection in the script. I did see Jason’s response and used some of his suggested syntax in the other Carbon Black post. The only part I didn’t use was “action uses wow64 redirection false”. Thanks

5

Try to uninstall silently manually, in the command prompt, and see if you have the parameters correct.

I’d expect a modification of your second try to work -

waithidden cmd.exe /c "C:\windows\CarbonBlack\uninst.exe /S"

On the Carbon Black page you linked (thanks for that!), it looks like the /S parameter is capitalized.

6

Hi. We also use Carbon Black Defender in addition to Response and you need a code in order to uninstall. Unfortunately, I don’t see that with Response, but I’ll keep looking. Thanks.

7

Thanks so much Jason! I used the syntax with the capital /S and it seemed to work. I also included the “action uses wow64 redirection false” in the script.
I do use this forum quite a bit for reference, but never posted. I’ll definitely be posting more in the future cause you guys rock! :metal:

3 Likes