Configuring Agent Management via User / Group or Global CLI Password

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps for configuring Agent Management which allows for authentication with the Agent.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions
• macOS: All Supported Versions
• Linux: All Supported Versions

Resolution

1. Log in to the Console using an an account with administrative privileges.
2. Navigate to Settings > System Configuration > General > Edit.
   • When choosing a user or group to manage Agents:
     • This option allows administrators to assign elevated dascli (b9cli) command privileges to specific Users or Groups.
     • This allows command prompts ran as a User or member of the specified Group to automatically be authenticated.
     • A pre-defined group drop down is available for Windows devices, otherwise a SID can be provided.
     • Each User / Group will need to exist on each endpoint.

• • When choosing to use a Global Password:

1. • • The Global CLI Password can be changed, but cannot be viewed.
     • Password length must be fewer than 64 characters, and be in the ASCII character set due to Microsoft Windows command line limitations.
     • Password should not contain the following DOS special characters as some older Microsoft Windows versions may not support them:

       |><&%()@.[]{}:;^=!'"`~,

2. Adjust the settings in Agent Management accordingly.

Additional Information

• Both a Global Password and User/Group could be configured for use (allows for either option to be used, does not require both).
• Agents must be Connected in order to receive changes.
• Agent Management settings are built into the Policy Installers when changed.
• If Agent Management settings are not configured/not known and an Agent is offline there will be no way to authenticate with an Agent for removal or other modification.