Cannot Connect to User Agent

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent not showing as Connected in Assets > Computers.
• Agent driver or kernel filter driver is not running
• Attempting to use dascli commands returns error:

  Cannot connect to user agent.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

This message is returned when the Agent service is not currently running. Typically this happens when:

• Agent service is Stopped, Restarting, or Disabled.
• Another software program injecting itself into the Agent, and not allowing the service to fully start.
• The installation has become corrupted.

Resolution

Typically this can be resolved with a reboot of the endpoint. However, if this does not work:

1. Verify Antivirus Exclusions for the Agent are in place for any other security product.
2. Click Start > Run > services.msc > Ok and locate the service, Carbon Black App Control Agent.
3. Attempt to manually upgrade the Agent to the latest version.
4. Verify the Startup Type is set to Automatic and verify the status is Running.
   • If the service fails to stay Running, capture a Low Altitude Procmon while recreating the issue and open a case with Support.
   • An Agent uninstall and a new Agent install may be required if the issue persists.

Additional Information

• By default the Agent service has the start type "auto" and the Agent driver has the start type "boot".
• The following commands in an administrative command prompt will set the Driver and Service accordingly:

  sc config parity start= auto
  sc config paritydriver start= boot

• The following administrative Windows commands can be used:

  Verify service status: sc query parity
  Verify driver status: sc query paritydriver
  Verify paritydriver is loaded: fltmc
  Verify paritydriver instances: fltmc instances