Carbon Black Cloud: USB device approvals/changes are not being recognized by a sensor.
book
Article ID: 285908
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Approving a USB device in the console's policy page, waiting 20 minutes for the change to download to the sensor, the USB device is still blocked.
Verified that the USB device is not being blocked by another mechanism such as GPO policy.
a) check the audit log for when the serial number of the USB device was approved
b) check the sensor status with the command "> C:\program files\confer\repcli status" It will show the last time the sensor downloaded policy content:
Last Manifest Content Update Time[10/06/2023 13:30:17]
If this is before the time the SN was approved, then new content containing the approval has not been downloaded.
c) Also check the repcli status for any ManifestDownloadFailure alarms. If there are no such alarms, then the sensor is able to reach the backend and download content, if content was available.
Environment
Carbon Black Cloud Sensor: All versions
Carbon Black Cloud Server: All versions (as of October 17, 2023)
Carbon Black Cloud Sensor platforms: All versions
Cause
Issue looks to be backend-related and is currently under investigation
Resolution
Back end issue resolved October 19th, 2023. There's also a new mechanism in place to monitor for this kind of problem.