App Control : Does the agent use its own time source for reporting events?
book
Article ID: 286366
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Does the agent keep its own time, or does it use the time of the endpoint its installed on?
Environment
App Control Server: All Versions
App Control agent: All Versions
Microsoft Windows OS: All Supported Versions
Resolution
No, the agent does not keep its own time. All events reported by the agent are stamped with the time reported by the endpoint OS.
Additional Information
Agents reporting "agent notification (time change)" events are having the time changed on the Windows OS. This could be done manually, or it could be drifting if the endpoint is not connected to an NTP source for time.