I. Disable Existing Mirror and Point to Carbon Black
- Ensure traffic to the new Signature Update Server URL is allowed through proxies and firewalls without packet inspection (TCP/80 or TCP/443)
updates2.cdc.carbonblack.io
- Disable Mirror Server
- Turn off the automated scheduling of do_update.bat (Windows Task Scheduler > Select Task > End and Disable)
- Stop IIS Website
- Open IIS Manager
- Expand Sites
- Right-click Site Name > Manage Website > Stop
II. Update all Policies with new Update Server URL
- Go to Enforce > Policies > select Policy > Local Scan tab
- Set the Update Servers URLs
http://updates2.cdc.carbonblack.io/update2
- Repeat steps 3 and 4 for all necessary policies
III. Update Mirror Server
- Download the latest mirror server package for Windows from CB Defense: Local Mirror Server for Signature Updates
- Extract the zip file and replace the matching files in the IIS directory with zip file contents
C:\inetpub\wwwroot\<LocalMirrorFolder>
- Turn on the automated scheduling of `do_update.bat` (Windows Task Scheduler > Select Task > Enable and Run)
If desired, SSL communications between the Local Mirror and CB update servers can be enabled by using `do_update_ssl.bat` instead of `do_update.bat` - Verify that updates occurred in Local Mirror Server directory by inspecting Date modified
C:\inetpub\wwwroot\<LocalMirrorFolder>\idx\master.idx
- Re-enable Local Mirror by starting IIS Website
- Open IIS Manager
- Expand Sites
- Right-click Site Name > Manage Website > Start
IV. Confirm Signature Update for All Affected Endpoints
- Go to the Endpoints page in the PSC Console
- Search for the desired Device Name
- Expand the Device Details
- Check 'Scan Engine' field for VDF version; Example:
Scan Engine: 4.11.0.307-ave.8.3.54.68:avpack.8.5.0.12:vdf.8.16.21.0:apc.2.10.0.110
- Any VDF Version above vdf.8.16.21.0 reflects an endpoint in an updated state
NOTE: In most cases endpoint will need to go through a reboot cycle in order to start successfully receiving updates. To expedite the process sensor can be upgraded or new signature pack deployed as described in
CB Defense: Signature Pack Version Has Not Updated Since August 1, 2019 (options B and C).
V. Point Endpoints back to Local Mirror
- From previous instructions confirm that local mirror is receiving updates
- From previous instructions confirm that all endpoints in policy are updated to a version greater than 8.16.21.0
- Go to Enforce > Policies > select Policy > Local Scan tab
- Set the Update Servers URLs to the URL for your local Mirror Server
- Verify that signatures continue to update on Sensors: CB Defense: How to verify AV Signatures are updating
- If signature updates have not resumed 24 hours after applying the solution, please open a support case