CB Protection: Notifier Not Displaying for Blocks by NT Authority/System

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Blocks by NT Authority System are not displayed on screen

Environment

• CB Protection Server: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

• To reduce widespread blocks on terminal servers, block notifiers are only displayed by default to the user account that triggered them. So the notifier would only have shown if the user was logged in as the System account. 
• More information can be found in the User Guide in the section "Notifiers in Windows Session Virtualization" which can be found in CB Protection Product Documents

Resolution

To change the default behavior the Notifier can be updated to display to all users.

1. Navigate in the CB Protection Console to Rules > Notifiers
2. Edit the Notifier you want to be displayed to all users
3. Add the following text to the end of the Notifier Text section:

   <NotifierBroadcastMessage>

Additional Information

Further information regarding the default, and other notifier options can be found within the CB Protection User Guide in the section "Notifiers in Windows Session Virtualization"