You can use the following command line parameters during a Windows sensor install.

Using commands or command line parameters other than those listed in the following table can cause the installation to fail.

Carbon Black Cloud supports automatic detection of proxy settings; however, it does not prompt for or pass the machine’s credentials for use in proxy authentication, if enabled. If proxy authentication is required for your environment, use the command line options to specify PROXY_SERVER=value, PROXY_USER=value, and PROXY_PASSWD=value. See Configure a Proxy.

Note:
  • Command options are case-sensitive.
  • With Windows sensors 3.3.0 and later, you can use the RepCLI command line tool to locally administer the sensor. For more information about RepCLI, see Managing Sensors by using RepCLI in the User Guide.

Command Options

Values

Supported with Updates

Notes

AUTO_CONFIG_MEM_DUMP=value true/false Yes Provides the ability to stop the sensor from automatically configuring the memory dump settings in the registry when set to false. Available for Windows sensors 3.5+.

AUTO_REREGISTER_FOR_CITRIX=value

true/false Yes

Default is false. When set to true, this setting enables auto-reregistration for Citrix PVS and MCS clones. Available for Windows sensors 3.7MR1+.

AUTO_REREGISTER_FOR_VDI_CLONES=value

4 - Checks for Hostname change (available from 3.8+)

3 - Checks for BIOS UUID + MAC HASH changes (preferred)​

2 - Checks for BIOS UUID change

1 - Auto Reregister disabled

Yes Default for Windows sensor 3.7MR2 is 1. Default for Windows sensor 3.8+ is 3. Sets auto-reregistration functionality for Horizon and vSphere VDI clones. Available for Windows sensors 3.7MR2+.
AUTO_UPDATE=value 1/0 or true/false No Default is true (enable auto update). This setting toggles whether the sensor will accept backend-pushed upgrade requests. Turning this off will prevent the update from being pushed from the backend.

BACKGROUND_SCAN=value

1/0 or true/false

No

Default is true. This setting toggles whether sensor will do an inventory of what hashes exist on the machine. Not applicable to Audit and Remediation Standalone.

BASE_IMAGE=value

1/0 or true/false

No

Default is false; the installed image is a base image that can be cloned to child images. This option is not supported for Non-Persistent VDI installations, but is currently used for Persistent VDI installations.

BYPASS=value

1/0 or true/false

No

Default is false; setting it to true will enable bypass mode

In bypass mode, the sensor does not send any data to the cloud: the sensor functions in a passive manner and does not interfere with or monitor the applications on the endpoint.

Installing the sensor in bypass mode enables thorough testing for interoperability issues.

CBLR_KILL=value

1/0

No

A value of 1 disables Live Response functionality for the sensor. The default value is 0.

Note: Not reversible without reinstalling the sensor.
CLI_USERS=sid

SID value for authenticated users group

No

Use this field to enable the RepCLI tool. Any member in the specified user group can use the authenticated RepCLI commands.

COMPANY_CODE=value

Company registration code

No

Required for command line installations.

CURL_CRL_CHECK 1/0 Yes Default is 1 (enabled). See Disable CURL CRL CHECK
CURL_CRL_REVOKE_BEST_EFFORT 1/0 Yes Default value is False.

When set to False, upon failing to receive revocation information for the SSL certificate, the sensor rejects connection with the backend server or the MITM proxy.

When set to True, the sensor will make a best effort attempt to verify the SSL certificate but will not reject the connection if revocation information can't be obtained due to firewall or other network restrictions.

Note: When CURL_CRL_CHECK=0 is set, CRL validation is skipped altogether and the CURL_CRL_REVOKE_BEST_EFFORT setting is not considered, however the sensor will always verify that the certificate is trusted in the local certificate store regardless of whether revocation checking is enabled.

DELAY_SIG_DOWNLOAD=value

1/0

No

Default is delay signature/definition download. We recommend that you do not change the default value.

FILE_UPLOAD_LIMIT=value

4-byte integer representing number of megabytes

No

Example: value of 3 is a limit of 3*1024*1024 bytes; default value is 5.

FORCE_STATIC_PROXY_USE true/false Yes When set to True, the sensor will always use a proxy to reach the Carbon Black Cloud backend and will not use the existing fallback mechanism of trying with other options if the configured proxy is not reachable. The default value is False.
Note: If this property is set after sensor installation, a reboot is required.

GROUP_NAME=value

String value

No

Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.7 and earlier. For Windows sensors 3.8+, use the POLICY_NAME parameter instead.

HIDE_COMMAND_LINES

1/0

No

Obfuscates command line inputs. Default is 0.

LAST_ATTEMPT_PROXY_SERVER

Value example: 10.101.100.99:8080

No

Optional. Sensor will attempt cloud access by using this setting when all other methods fail (including dynamic proxy detection).

OFFLINE_INSTALL=value

1/0 or true/false

No

Optional. Default is false. This parameter allows you to install sensors when the endpoint is offline. The sensor connects with the Carbon Black Cloud backend and accesses a policy when network connectivity is restored. The sensor is in a bypass state until the sensor can access the policy. This option is only available for Windows sensors v3.5 and later.

POLICY_NAME=value String value No Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.8+. For Windows sensors 3.7 and earlier, use the GROUP_NAME parameter instead.

PROXY_PASSWD=value

Proxy password

No

Optional.

PROXY_SERVER=value

server:port

No

Optional.

PROXY_USER=value

Proxy username

No

Optional.

USER_EMAIL=value

Email address

Example: [email protected]

No

Optional.

Note: This option is not valid for Windows Sensor versions 4.0+.

VDI=value

1/0 or true/false

No

This option is deprecated in sensor versions 3.4+. Default is false.

VHOST_COMMS=value

true/false Yes

Disables the VHostComms helper utility when set to false.