Managing the App Control Server License

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to import a new or renewed license file (.lic), verify the license was successfully applied, and what happens when the license expires.

Environment

• App Control Console: All Supported Versions

Resolution

Table of Contents

• Importing a new or updated Server License
  • Import License via Console
  • Import License via SQL
  • Import License on service start
• What happens when the Server License expires
• What happens when the License Endpoint Limit is Exceeded
• Determine or update the License Endpoint Limit

Importing a new or updated Server License

Import License via Console

1. Log in to the Console and navigate to the gear icon > System Configuration > Licensing.
2. Select one of the following options:
   • Specify License File: Upload the .lic file directly.
   • Paste License Key: Open the .lic file in a text editor, and copy the entire contents into the box provided.
3. After importing, verify:
   • Reports > Events shows a new Event with Subtype: License Added.
   • Settings > System Configuration > Licensing shows an updated License Expiration and/or updated Endpoint Limit.

Import License via SQL

1. Stop the App Control Server and App Control Reporter services.
2. Run SQL Server Management Studio as the Carbon Black Service Account.
3. Open the .lic file in a text editor and copy the value in the query:

   USE das;
   UPDATE shepherd_configs 
   SET value = 'VALUE FROM LIC'
   WHERE name = 'license'

4. Start the App Control Server & App Control Reporter services.
5. Log in to the Console and verify:
   • Reports > Events shows a new Event with Subtype: License Added.
   • Settings > System Configuration > Licensing shows an updated License Expiration and/or updated Endpoint Limit.

Import License on service start

1. Stop the App Control Server and App Control Reporter services.
2. Rename the new .lic file to: license.lic
3. Copy the file to: C:\Program Files (x86)\Bit9\Parity Server\
4. Start the App Control Server and App Control Reporter services.
5. Verify:
   • The license.lic file should be consumed on the service start, and removed from the folder.
   • Reports > Events shows a new Event with Subtype: License Added.
   • Settings > System Configuration > Licensing shows an updated License Expiration and/or updated Endpoint Limit.

What happens when the Server License expires

• 7 days prior to expiration multiple Events are generated with the Subtype: License Warning
  • An Alert can be created based on this Event.
  • This can be changed with the Shepherd Config Property: LicenseControlExpirationWarningLimitDays
• At midnight the day following the expiration, the Console and API will be come unavailable.
• No change is made to the Agents, they will continue using the specified Enforcement Level and Approvals.

What happens when the License Endpoint Limit is Exceeded

A warning will be displayed in the Console and the Account Team may reach out to request additional licenses be purchased.

• Exceeding the Endpoint Limit will not:
  • Impact the ability to log in to the Console.
  • Automatically disable or uninstall Agents.

Determine or update the License Endpoint Limit

1. Log in to the Console and navigate to Settings > System Configuration > Licensing.
   • Endpoint Limit is displayed here.
   • In Use is determined by machines in Visibility or any of the Control Modes (Low, Medium or High).
2. Verify Old Computer Cleanup is Enabled and configured correctly.
3. If using Template Computers or Template Images, verify Clone Cleanup Settings are configured correctly.
4. Total Licenses In Use is updated each night with the DailyPruneTask.

Additional Information

• Once a .lic file has been imported or added to the App Control Console the details of the file are saved in the DAS database.
• The .lic file can safely be moved to a backup location in the event the file is needed to re-import for any reason in the future.
• The Activation Key is used for connecting the App Control Server to the Reputation Service, is separated by dashes, and associated with the License Key, example:

  XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

• The License Key is used to determine the number of Agents allowed to run in each Control Mode (Visibility, Low, Medium, High) and is a longer & encoded value.
• Contact Global Customer Assistance to make changes to the License Key (endpoint count, renewal, etc).