Sensor Not Upgrading If Installed With AUTO_UPDATE=0

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)

Issue/Introduction

• Sensor update pushed from Web Console
• Sensor Update Status page shows "Update error"
• Sensor Update Status export shows:
  • Update Status = FAILURE_EJECTED
  • Status Reason = Job Expired
• cfg.ini shows:

  AUTO_UPDATE=0

• confer.log file shows the following:

  RepUtilCheckHintIndicators: sw upgrade is disabled

Environment

• Carbon Black Cloud Web Console: All Versions
• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

Sensor was installed with AUTO_UPDATE=0 switch and an update was pushed out via Web Console.

Resolution

AUTO_UPDATE is set upon installation and cannot be changed without an uninstall and re-install of the Sensor

1. Uninstall the Sensor from the impacted endpoint
2. Re-install the Sensor on the impacted endpoint

Additional Information

You can find all sensors with this setting by searching for "sensorStates:AUTO_UPDATE_DISABLED" on the inventory page.