App Control: Unable to Approve Hard Drives that are Being Recognized as SCSI Drives

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• USB device was first attached while Agent 8.5.x (or lower) was installed.
• USB device being reported with the Device Class: SCSI Device.
• Unable to issue an Approval for the USB device due to being a Non-removable Device.

Environment

• App Control Console: All Supported Versions
• App Control Agent: 8.0.x - 8.5.x
• USB Device originally attached while a matching Agent version was installed

Cause

A defect in the Agent was not correctly identifying some devices as 'Removable'. This defect was tracked under EP-7979 and fixed with the release of Agent version 8.6.0.

Resolution

Upgrading to Agent version 8.6.0 or higher will prevent this issue. However, if the device_id was first seen by an impacted Agent version, the issue on the Server may persist.

To alter the Removable state of a device first seen by an impacted Agent version:

1. Log in to the application server as the Carbon Black Service Account.
2. Use SQL Server Management Studio to execute the following query:

   use das; select device_id, host_id, first_seen_date, name, vendor, friendly_name, is_removable from devices (nolock)

3. Locate & verify the relevant device_id
4. Using the device_id in place of X, adjust the device's status with the following query:

   use das; UPDATE devices SET is_removable=1 WHERE device_id=X

5. Attempt to issue the Approval.

Additional Information

• These steps should only be followed for devices originally attached to the endpoint while Agent 8.0.x - 8.5.x was installed. 
• If encountering this issue for devices that were attached after 8.6.0+ was installed, please open a case with Support instead.
• The device information collected by the Agent should match what Windows reports in

  System Information > Components > Storage > Disks > relevant Disk Drive > Media Type