Carbon Black Cloud: Some Apple macOS sensors are enrolled with same non-existent user.

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

1. The sensors page in the Console lists the nonexistent user in several sensor's user fields.
2. The View Company Codes in the Console shows that nonexistent user (i.e. "ABCD123") is a v1.x-v2 company code but this sensor is installing a 3.5.x version.
3. The cfg.ini on the sensor shows the nonexistent user in both the CompanyCode and EmailAddress fields as so:

CompanyCode=ABCD123 <------
BackendServer=dev-prod05.conferdeploy.net
DeviceId=fdc02854563f129a47e8482e54ada2d5e295eb3efabb09647d1da2d0e24253d8
EmailAddress=ABCD123 <------

Environment

• Endpoint Standard Apple macOS Sensor: All versions prior to 3.6
• Carbon Black Cloud Console: All versions
• Apple macOS: All Supported Versions

Cause

This is issue "DSEN-15782"

Resolution

DSEN-15782 is fixed in the Apple macOS 3.6.x sensor release.