Perform the following procedure to remove Carbon Black EDR packages and all third-party packages upon which it relies.

Caution: This procedure might remove packages that are also required by other software applications. Use caution when performing this procedure.


  1. Stop the Carbon Black EDR services by using one of the following commands:
    sudo /usr/share/cb/cbcluster stop
    sudo service cb-enterprise stop
  2. Access the yum.conf file by using the following command:
    vi /etc/yum.conf
  3. Add the following line to yum.conf:
  4. Enter the following:
    yum erase cb-enterprise
  5. Enter the following:
    yum remove carbon-black-release
  6. Manually remove the following directories:
    • /var/www/cb/
    • /var/run/cb/
    • /var/log/cb/
    • /var/lib/cb/
    • /var/cb/
    • /usr/share/cb/
    • /etc/cb/