Troubleshooting Disconnected Agents (macOS)

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Endpoints are showing as Disconnected in the Console under Assets > Computers.
• Endpoints are not showing in the Console under Assets > Computers.
• Endpoints are experiencing general communication issues with the App Control Server.

Environment

• App Control Agent: All Supported Versions
• App Control Server: All Supported Versions
• macOS: All Supported Versions

Resolution

1. Verify the Server-Agent Certificate in the Console > System Configuration > Security is not expired, and formatted correctly.
   • Common Name shown should match Server Address from the General tab.
   • Expiration Date should be in the future.
   • A matching Certificate should be listed in the Trusted Communication Certificates list at the bottom of the Security tab, and Trusted.
2. If Certificate Verification is enabled the Agent Communication Certificate may need to be imported on the endpoint(s).
3. Verify the Agent and macOS combination being used is supported.
4. Verify all macOS Agent Exclusions are added to any other security product on the endpoint.
5. Verify the Agent Kernel Extensions are loaded and the Agent is fully running.
6. Verify Full Disk Access (FDA) was granted to the Agent:

   System Preferences > Security & Privacy > Privacy > Full Disk Access > appc-es-extension

7. Open a terminal and issue the following commands:

   cd /Applications/Bit9/Tools/
   ./b9cli --status

8. Note the Server Address from the results.
9. Verify the endpoint can communicate with the Server Address by running the following commands:

   ping <SERVERADDRESS>
   nslookup <SERVERADDRESS>
   nc -vz <SERVERADDRESS> 41002
   nc -vz <SERVERADDRESS> 443
   

Additional Information

If issues persists, please open a case with Support and provide the Disconnected Agent Logs.