You can use the following command line parameters during a Windows sensor install.
Using commands or command line parameters other than those listed in the following table can cause the installation to fail.
Carbon Black Cloud supports automatic detection of proxy settings; however, it does not prompt for or pass the machine’s credentials for use in proxy authentication, if enabled. If proxy authentication is required for your environment, use the command line options to specify PROXY_SERVER=value, PROXY_USER=value, and PROXY_PASSWD=value. See Configure a Proxy.
- Command options are case-sensitive.
- With Windows sensors 3.3.0 and later, you can use the
RepCLIcommand line tool to locally administer the sensor. For more information about RepCLI, see Managing Sensors by using RepCLI in the User Guide.
| Command Options |
Values |
Supported with Updates | Notes |
|---|---|---|---|
AUTO_CONFIG_MEM_DUMP=value |
true/false | Yes | Provides the ability to stop the sensor from automatically configuring the memory dump settings in the registry when set to false. Available for Windows sensors 3.5+. |
| |
true/false | Yes | Default is false. When set to true, this setting enables auto-reregistration for Citrix PVS and MCS clones. Available for Windows sensors 3.7MR1+. |
AUTO_REREGISTER_FOR_VDI_CLONES=value |
4 - Checks for Hostname change (available from 3.8+) 3 - Checks for BIOS UUID + MAC HASH changes (preferred)2 - Checks for BIOS UUID change 1 - Auto Reregister disabled |
Yes | Default for Windows sensor 3.7MR2 is 1. Default for Windows sensor 3.8+ is 3. Sets auto-reregistration functionality for Horizon and vSphere VDI clones. Available for Windows sensors 3.7MR2+. |
AUTO_UPDATE=value |
1/0 or true/false | No | Default is true (enable auto update). This setting toggles whether the sensor will accept backend-pushed upgrade requests. Turning this off will prevent the update from being pushed from the backend. |
| |
1/0 or true/false |
No | Default is true. This setting toggles whether sensor will do an inventory of what hashes exist on the machine. Not applicable to Audit and Remediation Standalone. |
|
|
1/0 or true/false |
No | Default is false; the installed image is a base image that can be cloned to child images. This option is not supported for Non-Persistent VDI installations, but is currently used for Persistent VDI installations. |
|
|
1/0 or true/false |
No | Default is false; setting it to true will enable bypass mode In bypass mode, the sensor does not send any data to the cloud: the sensor functions in a passive manner and does not interfere with or monitor the applications on the endpoint. Installing the sensor in bypass mode enables thorough testing for interoperability issues. |
CBLR_KILL=value |
1/0 |
No | A value of 1 disables Live Response functionality for the sensor. The default value is 0.
Note: Not reversible without reinstalling the sensor.
|
CLI_USERS=sid |
SID value for authenticated users group |
No | Use this field to enable the |
|
|
Company registration code |
No | Required for command line installations. |
CURL_CRL_CHECK |
1/0 | Yes | Default is 1 (enabled). See Disable CURL CRL CHECK |
CURL_CRL_REVOKE_BEST_EFFORT |
1/0 | Yes | Default value is False. When set to False, upon failing to receive revocation information for the SSL certificate, the sensor rejects connection with the backend server or the MITM proxy. When set to True, the sensor will make a best effort attempt to verify the SSL certificate but will not reject the connection if revocation information can't be obtained due to firewall or other network restrictions.
Note: When
CURL_CRL_CHECK=0 is set, CRL validation is skipped altogether and the
CURL_CRL_REVOKE_BEST_EFFORT setting is not considered, however the sensor will always verify that the certificate is trusted in the local certificate store regardless of whether revocation checking is enabled.
|
|
|
1/0 |
No | Default is delay signature/definition download. We recommend that you do not change the default value. |
|
|
4-byte integer representing number of megabytes |
No | Example: value of 3 is a limit of 3*1024*1024 bytes; default value is 5. |
FORCE_STATIC_PROXY_USE |
true/false | Yes | When set to True, the sensor will always use a proxy to reach the Carbon Black Cloud backend and will not use the existing fallback mechanism of trying with other options if the configured proxy is not reachable. The default value is False.
Note: If this property is set after sensor installation, a reboot is required.
|
|
|
String value |
No | Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.7 and earlier. For Windows sensors 3.8+, use the POLICY_NAME parameter instead. |
|
|
1/0 |
No | Obfuscates command line inputs. Default is 0. |
|
|
Value example: 10.101.100.99:8080 |
No | Optional. Sensor will attempt cloud access by using this setting when all other methods fail (including dynamic proxy detection). |
|
|
1/0 or true/false |
No | Optional. Default is false. This parameter allows you to install sensors when the endpoint is offline. The sensor connects with the Carbon Black Cloud backend and accesses a policy when network connectivity is restored. The sensor is in a bypass state until the sensor can access the policy. This option is only available for Windows sensors v3.5 and later. |
POLICY_NAME=value |
String value | No | Optional policy name assignment. Enclose this value with double quotes if the policy name includes spaces. Use this parameter for Windows sensors 3.8+. For Windows sensors 3.7 and earlier, use the GROUP_NAME parameter instead. |
|
|
Proxy password |
No | Optional. |
|
|
server:port |
No | Optional. |
|
|
Proxy username |
No | Optional. |
|
|
Email address Example: [email protected] |
No | Optional.
Note: This option is not valid for Windows Sensor versions 4.0+.
|
|
|
1/0 or true/false |
No | This option is deprecated in sensor versions 3.4+. Default is false. |
|
|
true/false | Yes | Disables the VHostComms helper utility when set to false. |
