Carbon Black Cloud: Some Apple macOS sensors are enrolled with same non-existent user.
book
Article ID: 285922
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
The sensors page in the Console lists the nonexistent user in several sensor's user fields.
The View Company Codes in the Console shows that nonexistent user (i.e. "ABCD123") is a v1.x-v2 company code but this sensor is installing a 3.5.x version.
The cfg.ini on the sensor shows the nonexistent user in both the CompanyCode and EmailAddress fields as so: