Find macOS Sensors Where Full Disk Access (FDA) Has Not Been Granted
search cancel

Find macOS Sensors Where Full Disk Access (FDA) Has Not Been Granted

book

Article ID: 285061

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Find macOS Sensors in the console that do not have Full Disk Access (FDA) granted 

Environment

  • Carbon Black Cloud Console
  • Carbon Black Cloud Sensor: 3.7.4.53 Sensor and older
  • Apple macOS: 10.14.5 and higher

Resolution

1. Log in to the Carbon Black Cloud Console
2. Navigate to Inventory > Endpoints
3. Use the search bar to enter the following query:
sensorStates:FULL_DISK_ACCESS_NOT_GRANTED
4. The results will populate with Sensors that do not have FDA access enabled
 

Additional Information

  • For the macOS Sensor to operate at full functionality on an endpoint that is running macOS 10.14.5 and higher, the sensor must have Full Disk Access granted. 
  • How to enable Full Disk Access