Change Enforcement Level (Locally)

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to change an Agent's Enforcement Level locally when the Server is disconnected, or otherwise unavailable.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions
• macOS: All Supported Versions
• Linux: All Supported Versions

Resolution

Important Notes:  Enforcement Level of the Agent is controlled by the Server. If the connection to the Server is active, or restored, the Enforcement Level will not be able to be set locally. This means the Agent must be instructed to disconnect from the Server first, even if the connection is otherwise unavailable. These commands will require authentication in order to be successfully entered. If the Global Password is not known, modification of the Enforcement Level will not be possible. The proper way to adjust the Enforcement Level is by moving the Agent to the relevant Policy via the Console. This allows the Agent to also honor Custom Rules, Publisher Approvals, etcetera relevant for the Enforcement Level and the role of the machine.

Windows:

cd "C:\Program Files (x86)\Bit9\Parity Agent"
dascli password GlobalPassword
dascli disconnect
dascli enforcement <low/med/high/disabled/visibility>

Linux:

cd /opt/bit9/bin
./b9cli --password GlobalPassword
./b9cli --disconnect
./b9cli --enforcement <low/med/high/disabled/visibility>

macOS:

cd /Applications/Bit9/Tools/
./b9cli --password GlobalCLIPassword
./b9cli --disconnect
./b9cli --enforcement <20/30/35/40/60/80>

Additional Information

• When Enforcement is set via the cli commands, it will not persist a reboot or if the connection to the Server is restored.
• The numerical Enforcement Levels/Values are:
  • High Enforcement: 20
  • Medium Enforcement: 30
  • Low Enforcement: 40
  • Local Approval: 35
  • Visibility: 60
  • Disabled: 80