CB Response: Error: "Node [0 ] 400 - Bad Request ([u'user_already_exists', u'cb']"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Error when starting CB Response cluster services: "Node [0 ] 400 - Bad Request ([u'user_already_exists', u'cb']) (users/cb) ('{"password: "'<password>'", "tags" <tags>}') "

Environment

• CB Response: version 6.x
• RedHat OS
• CB Response Server previously removed and re-installed

Cause

• Linux OS user "cb" already exists, probably due to a previous installation of CB Response
• User "cb" and other CB Response-related users are not removed when CB Response is uninstalled

Resolution

1. Ensure CB Response is fully uninstalled from the server node.
2. Remove the specified user from the Linux OS filesystem (eg, user "cb")

# userdel cb

3. Re-install the CB Response server onto the server node.
4. Restart the cluster.

Additional Information

• There may be other users besides "cb" that need to be deleted. The system will throw a similar error when the cluster starts if those users need to be deleted.