App Control: How to Tell Why a Device Moved Into Another Policy
book
Article ID: 288745
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
How to tell who, or what changed a device's policy
Environment
App Control Console: All Supported Versions
App Control Agent: All Supported Versions
Resolution
In the Events page, filter on the Subtype "Computer Modified". This event contains multiple items which will help understand why a device moved policies.
Computer was moved by a user:
Computer '$computer$' was moved into the Policy '$policyName$' by '$username$'.
Computer was moved by automatic policy (such as Active Directory Policy Mapping)
Computer '$computer$' was modified by '$username$' to use automatic Policy assignment.
Moved back to a policy from Local Approval Mode:
Computer '$computer$' was restored to its previous Policy by '$username$'.
Additional Information
If a device is being moved automatically it is generally because of an Event Rule or Active Directory Policy Mapping
Check under Rules>Event Rules to see if there are any rules that have an action of "move computer" to another policy