Preparing to Decommission the Environment
search cancel

Preparing to Decommission the Environment

book

Article ID: 288720

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to prepare the environment for full removal of all Agents prior to decommissioning the App Control Server.

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions

Resolution

  1. Verify the status of Agents currently showing as Disconnected in the Console under: Assets > Computers > Saved Views > Disconnected Computers.
    • Any Computer currently Disconnected with an installed Agent may need to have the Agent manually uninstalled locally (see Additional Notes).
  2. Verify the Agent Management settings.
    1. Test authenticating with an Agent via dascli or b9cli to confirm.
    2. Test manually uninstalling an Agent via the command line.
      • After the Console is decommissioned there will be no way to change the Agent Authentication and removal options will be greatly limited.
  3. Verify no Policy is currently using the option, "Load Agent in Safe Mode".
    • Removal of an Agent in a Disconnected status, without authentication, will require locally moving the endpoint into Safe Mode with an Administrative account.
  4. Globally disable Tamper Protection and enable Agent Uninstall to make future removal easier.
    1. Log in to the Console and navigate to: https://ServerAddress/support.php
    2. Choose: Advanced Configuration > Agent Configuration.
    3. Enable both options:
      • Enable Agent Uninstall
      • Disable Tamper Protection
  5. Verify Computers in Assets > Computers are showing as Up To Date with the new Tamper Protection & Agent Uninstall settings.
  6. Create an Agent Config that allows for the immediate, and irreversible, removal of all Agents in the specified Policy or Policies.
    • Note: The Host ID should be set to 0 to have the Agent Config applied to all Agents & the Policy should be set to, "All current and future policies".
    • WARNING: This step should be completed only once it is confirmed all endpoints are ready for the Agent to be removed.

Additional Information

  • Once an Agent is Disconnected from the Console the only available options for removal are via authentication or Safe Mode.
  • Follow the proper steps above 
Powered by Wolken Software