What Happens When a Carbon Black Cloud License Expires

Products

• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Workload

Issue/Introduction

What happens when a Carbon Black Cloud license expires?

Environment

• Carbon Black Cloud Console: All versions

Resolution

Stage 1: Grace Period

• On the day of expiration, the Carbon Black Cloud org will enter a renewal grace period. A Banner will display in the UI stating when the grace period ends. During this time, you retain full access to all services and data, and you can still renew your subscription.

• • If you believe your license has not expired and this banner is visible:
    1. Confirm you have followed the Tenant Hold Process
    2. Open a Non-Technical case to have your license validated.
       • If a valid license is not found you may be asked to contact your Account Director, Catalyst Partner, or Reseller
  • If you believe your license has expired, but this banner is not visible:
    • This means that there has been a mistake with the automated decommissioning process and the org is not currently marked for removal. A manual audit will catch any orgs that have not yet been marked. See How To Request a Carbon Black Cloud Org be Decommissioned OR contact your Account Director, Catalyst Partner, or Reseller for renewal. 

Stage 2: Waiting Period

• If your product license is not renewed by the end of the renewal grace period, your services will enter a 30-day waiting period. During this time, you will lose access to all services and data, and the console will attempt to switch all sensors into bypass mode. Your data is preserved with the exception of any data that exceeds your data retention limits. Your data will continue to be deleted over time, according to your data retention settings. You can still renew your subscription to regain access.

Stage 3: Decommission / Deletion

• If your product license is not renewed by the end of the waiting period, all of your data will be marked for deletion and subsequently deleted. The console will attempt to uninstall the sensors from all assets. After it is marked for deletion, your data cannot be recovered and re-creation of the Org is not possible.

Additional Information

• After your organization has been marked for deletion, sensors will need to be uninstalled manually from each asset. If the setting “Require code to uninstall sensor” was enabled in the asset's assigned policy, the company deregistration code is required to uninstall the sensor.
• To find the company deregistration code before your organization is marked for deletion, see Require Codes to uninstall Sensors at an Endpoint.
• Some add-on features, such as Managed Detection and Response or Extended Detection and Response (XDR), can expire individually and stop functioning even though the base features such as Endpoint Standard or Enterprise EDR continue to function.