You can use the following command line parameters during a Windows sensor install.

Using commands or command line parameters other than those listed in the following table can cause the installation to fail.

Carbon Black Cloud supports automatic detection of proxy settings; however, it does not prompt for or pass the machine’s credentials for use in proxy authentication, if enabled. If proxy authentication is required for your environment, use the command line options to specify PROXY_SERVER=value, PROXY_USER=value, and PROXY_PASSWD=value. See Configure a Proxy.

Note:
  • Command options are case-sensitive.
  • With Windows sensors 3.3.0 and later, you can use the RepCLI command line tool to locally administer the sensor. For more information about RepCLI, see Managing Sensors by using RepCLI in the VMware Carbon Black Cloud User Guide.

Command Options

Values

Supported with Updates

Notes

AUTO_CONFIG_MEM_DUMP=value true/false Yes Provides the ability to stop the sensor from automatically configuring the memory dump settings in the registry when set to false. Available for Windows sensors 3.5+.

AUTO_REREGISTER_FOR_CITRIX=value

true/false Yes

Default is false. When set to true, this setting enables auto-reregistration for Citrix PVS and MCS clones. Available for Windows sensors 3.7MR1+.

AUTO_REREGISTER_FOR_VDI_CLONES=value

4 - Checks for Hostname change (available from 3.8+)

3 - Checks for BIOS UUID + MAC HASH changes (preferred)​

2 - Checks for BIOS UUID change

1 - Auto Reregister disabled

Yes Default for Windows sensor 3.7MR2 is 1. Default for Windows sensor 3.8+ is 3. Sets auto-reregistration functionality for Horizon and vSphere VDI clones. Available for Windows sensors 3.7MR2+.
AUTO_UPDATE=value 1/0 or true/false No Default is true (enable auto update). This setting toggles whether the sensor will accept backend-pushed upgrade requests. Turning this off will prevent the update from being pushed from the backend.

BACKGROUND_SCAN=value

1/0 or true/false

No

Default is true. This setting toggles whether sensor will do an inventory of what hashes exist on the machine. Not applicable to Audit and Remediation Standalone.

BASE_IMAGE=value

1/0 or true/false

No

Default is false; the installed image is a base image that can be cloned to child images. This option is not supported for Non-Persistent VDI installations, but is currently used for Persistent VDI installations.

BYPASS=value

1/0 or true/false

No

Default is false; setting it to true will enable bypass mode

In bypass mode, the sensor does not send any data to the cloud: the sensor functions in a passive manner and does not interfere with or monitor the applications on the endpoint.

Installing the sensor in bypass mode enables thorough testing for interoperability issues.

CBLR_KILL=value

1/0

No

A value of 1 disables Live Response functionality for the sensor. The default value is 0.

Note: Not reversible without reinstalling the sensor.
CLI_USERS=sid

SID value for authenticated users group

No

Use this field to enable the RepCLI tool. Any member in the specified user group can use the authenticated RepCLI commands.

COMPANY_CODE=value

Company registration code

No

Required for command line installations.

CONNECT_LIMIT=value

Number of connections per hour

No

Optional; default is no limit.

CURL_CRL_CHECK 1/0 Yes Default is 1 (enabled). See Disable CURL CRL CHECK

DELAY_SIG_DOWNLOAD=value

1/0

No

Default is delay signature/definition download. We recommend that you do not change the default value.

FILE_UPLOAD_LIMIT=value

4-byte integer representing number of megabytes

No

Example: value of 3 is a limit of 3*1024*1024 bytes; default value is 5.

GROUP_NAME=value

String value

No

Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.7 and earlier. For Windows sensors 3.8+, use the POLICY_NAME parameter instead.

HIDE_COMMAND_LINES

1/0

No

Obfuscates command line inputs. Default is 0.

LAST_ATTEMPT_PROXY_SERVER

Value example: 10.101.100.99:8080

No

Optional. Sensor will attempt cloud access by using this setting when all other methods fail (including dynamic proxy detection).

LEARNING_MODE=value

Value is the number of hours after sensor install to limit event types.

This is a mechanism for reducing the load on the backend by dropping some report types after initial install.

Generally, more reports are sent to the backend soon after sensor install because the sensor reports on newly detected hashes.

Learning mode reports only on file and process behavior while the sensor is detecting hashes. Reporting of API, registry, and network behavior is dropped during this period.

No

Optional; default is disabled.

OFFLINE_INSTALL=value

1/0 or true/false

No

Optional. Default is false. This parameter allows you to install sensors when the endpoint is offline. The sensor connects with the Carbon Black Cloud backend and accesses a policy when network connectivity is restored. The sensor is in a bypass state until the sensor can access the policy. This option is only available for Windows sensors v3.5 and later.

POLICY_NAME=value String value No Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.8+. For Windows sensors 3.7 and earlier, use the GROUP_NAME parameter instead.

PROXY_PASSWD=value

Proxy password

No

Optional.

PROXY_SERVER=value

server:port

No

Optional.

PROXY_USER=value

Proxy username

No

Optional.

QUEUE_SIZE=value

Event backlog in MB

No

Optional; default is 100MB; this value does not include SSL overhead.

RATE_LIMIT=value

KB per hour

No

Optional; default is No Limit.

USER_EMAIL=value

Email address

Example: user@example.com

No

Optional.

VDI=value

1/0 or true/false

No

This option is deprecated in sensor versions 3.4+. Default is false.

VHOST_COMMS=value

true/false Yes

Disables the VHostComms helper utility when set to false.