Bypass (Contact support) due to System Extension Approval after Upgrade

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• After upgrade, device shows Bypass (Contact support) in the Inventory page of the console
• Reboot of the OS did not help
• Install log may display the following error:

no system extension activated
no system extension waiting for activation

• Confer log may display the following error:

Checking if previously un-approved system extension is running, will restart repmgr if running
System extension not reported running, no repmgr restart
Regmgr waiting for system extension approval

 

Environment

• Carbon Black Cloud Sensor: 3.6.x and Higher
• Apple macOS: 10.15 and Higher (Catalina)

Cause

System Extension was not approved on the device.

Resolution

1. To approve the network extension after the fact these steps can be used or the install can be rerun
2. Error(System ext. not approved) can be caused if in System Settings - Privacy & Security - Full Disk Access - com.vmware.carbonblack.cloud.se-agent.extension is not enabled
3. Also depending on the MacOS version check General -> Login Items & Extensions -> Endpoint Security Extensions -> VMware CBCloud

Additional Information

• Example:

sudo /Volumes/CBCloud-3.5.1.19/docs/cbcloud_install_unattended.sh -i /Volumes/CBCloud-3.5.1.19/CBCloud\ Install.pkg -c [Company Registration Code] -e

• If Error (FDA) is also seen along with the above make sure the steps here have been followed