Health Check FailureId[980]: Missing Keychain File

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent generating Events with Health Check FailureId[980] similar to:

  Carbon Black App Control Agent is missing a keychain file... FailureId[980]

Environment

• App Control Server: 8.7 and higher
• App Control Agent: 8.7 and higher

Cause

The keychain.json file is missing from the Agent's data folder:

C:\ProgramData\Bit9\Parity Agent\

Resolution

Resolve The Issue:

Manually import the keychain.json file on the endpoint(s).

Prevent The Issue:

1. Verify any new deployments are using the latest Policy Installer to install the Agent.
   • The latest keychain.json file is built into the Policy Installers when generated.
   • By default, Policy Installers regenerate at least once every 24 hours.
2. Verify the Resource Download Location in System Configuration > Advanced is still accurate, and contains the latest version of keychain.json.
   Note: If this location has been customized: copy the updated files to the new custom RDL
3. Verify the IIS Certificate bound to Port 443 is not expired, and formatted correctly
   • Common Name shown should match Server Address from the General tab.
   • Expiration Date should be in the future.
   • A matching Certificate should be listed in the Trusted Communication Certificates list at the bottom of the Security tab, and Trusted.
4. Verify the endpoints are able to download keychain.json via the RDL. By default this would be:

   Server 8.10.2+:
   https://ServerAddress/packages/keychain.json
   
   Server 8.10.0 and below:
   https://ServerAddress/hostpkg/pkg.php?pkg=keychain.json

5. Verify all other security products have the Antivirus Exclusions for the Agent in place.