App Control: Duplicate Server SID

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

The Carbon Black Support Team has reached out and state they detected duplicate SID's reporting into CDC

Environment

• App Control Server: All Supported Versions
• Microsoft Windows Server: All Supported Versions

Cause

Multiple App Control Servers sharing the same SID, often as a result of cloning a Server. Each Server must have its own unique "ParityCenterSIDHash". Each Reputation Key is associated with a Service License. The combination of these generates a unique Server ID.
 

Resolution

1. Use SQL Server Management Studio as the Carbon Black Service Account and execute the following query for each Server:

   use DAS;
   SELECT name, value FROM dbo.shepherd_configs (nolock) WHERE name in ('ParityServerVersion', 'ActivationState', 'ActivationVerified', 'ActivationKey', 'ParityCenterSIDHash');

2. Each Server should have its own unique "ParityCenterSIDHash". If 2 (or more) servers have the same SID, do the steps below on each duplicated server. (If there is only one server, do the same steps on just the one).
3. Reset the Server ID for each duplicated Server. (Not needed on the original Server)
4. Import the correct License Key for the corrected Server(s).
5. In the Console navigate to: Settings > System Configuration > Licensing. Enter the correct Carbon Black File Reputation Key.
6. Click Accept Terms and Activate > Review and accept the terms.
7. Return to the Console and click Verify.

Additional Information

• Each Server should have a unique License Key and Reputation Key. The combination of these generates a unique Server ID.
• Each Server requires a unique SID.
• Even if the environment has a single Server, these steps may be necessary if a duplicated SID was detected in the backend.