Health Check FailureId[761]: Agent Service Not Running with the Correct User Account

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent service unable to start
• Agent reporting errors similar to:

  The agent service is not running with the correct user account. FailureId[761]

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The Agent Health Check Guide states:

Parity.exe is expected to run as Local System (S-1-5-18) in order to ensure it has the appropriate permissions to access all files on local volumes. Use services.msc to ensure that parity runs as this user account (changes require disabling tamper).

Resolution

1. Verify the OS build & Agent version are supported.
2. Verify Agent Exclusions are in place.
3. Verify the Service is configured correctly:
   1. Use an administrative command prompt to verify the Agent is fully stopped & unloaded.
   2. In Services (services.msc) locate Carbon Black App Control Agent.
   3. Right-click > Properties > Log On > verify:
      • Log on as: Local System Account
      • Allow service to interact with desktop: Unchecked
   4. Load the Agent driver then start the service.
   5. Run a new Health Check to verify the issue is resolved.

If the issue persists, the Agent will need to be fully uninstalled and reinstalled.