App Control: How to Tell Why a Device Moved Into Another Policy

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to tell who, or what changed a device's policy

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

In the Events page, filter on the Subtype "Computer Modified". This event contains multiple items which will help understand why a device moved policies. 

• Computer was moved by a user:

  Computer '$computer$' was moved into the Policy '$policyName$' by '$username$'.

• Computer was moved by automatic policy (such as Active Directory Policy Mapping)

  Computer '$computer$' was modified by '$username$' to use automatic Policy assignment.

• Moved back to a policy from Local Approval Mode:

  Computer '$computer$' was restored to its previous Policy by '$username$'.

Additional Information

• If a device is being moved automatically it is generally because of an Event Rule or Active Directory Policy Mapping
• Check under Rules>Event Rules to see if there are any rules that have an action of "move computer" to another policy