EDR: User Removed From SSO but Still Present in Teams

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• User is removed from SSO but the user can still be seen in Teams but cannot be removed.

Environment

• EDR On-Premise: All Supported Versions
• EDR Cloud: All Supported Versions

Cause

• Leftover items in Postgres that weren't removed during the users initial removal.

Resolution

• Verify if that user is still present in the cb_user table:

psql cb -p 5002 -c "select * from cb_user;"

• If still present, removal should go as follows:

psql cb -p 5002 -c "DELETE FROM cb_user WHERE id in (<deleted_user's_id>);"

• It may also be required to remove the user from the user_role table, if the foreign key constraint will not allow the deletion above.
  • If any issues are encountered or anything is unclear, please contact VMWare Carbon Black Support, since tampering with the DB can have unintended consequences if mistakes are made.
• If this is for a cloud instance, please contact VMWare Carbon Black Support.