App Control: Agent Property to Improve Login Performance

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Slow log in times with the Agent installed.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions
• Virtual Environment

Cause

The Agent has been configured with a large number of rules to process during login, or this is a multi-user or VDI environment.

Resolution

1. Verify that the VDI Golden Image is in its own Policy.
2. Navigate to https://ServerAddress/agent_config.php
3. Click Show Filters > Value > contains > reevaluate_on_logon > Apply
4. Either Modify the existing Agent Config, or click Add Agent Config and use the following:
   • Name: Disable Reevaluate On Logon
   • Host ID: 0
   • Platform: Windows
   • Value:

     reevaluate_on_logon=0

   • Policy: Select the relevant VDI Policy (or Policies)
   • Status: Enabled
5. Save the Agent Config and verify the changes are applied to the Golden Image (and Clones) accordingly.

Additional Information

• When "reevaluate_on_logon" property is set to false, it will block the reevaluation of loaded processes on the system during user logon.
• This is useful in multi-user systems, where the repeated reevaluation of processes against the rules can be very expensive and slow logon times.