Cb Defense: Sensor Version 3.1.x.x and Higher Fails at KEXT Approval Stage When Skip KEXT Approval Switch is Used

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Unattended install with --skip-kext-approval-check switch added to command string
• No prompts are received for kext approval
• Generic "The Installation Failed" message screen

Environment

• Cb Defense Sensor: 3.1.x.x and higher
• Apple macOS: 10.13.0 and higher

Cause

The command string syntax is preventing the --skip-kext-approval-check switch from being read.

Resolution

Format the command string with single quotes surrounding the installer path and the company code to ensure the switch is read.

Example:

sudo /tmp/cbdefense_install_unattended.sh -i ‘/tmp/CbDefense Install.pkg’ -c ‘ExampleCompanyCode’ --skip-kext-approval-check

Additional Information

• The generic installation failure message likely indicates a failure during the pre-install script. Further details can be found in the confer-preinstall-timestamp.log file written to the same directory as the unattended install script (cbdefense_install_unattended.sh).
• Rather than adding a switch to the command string, the kext approval parameter within the install script (cbdefense_install_unattended.sh) can be modified. Alter the below line value to "1". After modifying, save script and install following these steps 

  ALLOW_INSTALL_UPGRADE_WITHOUT_KEXT_PREAPPROVAL=1

• If issue still fails, the options to pre-approve kexts through MDM profiles and manual approval of Kexts in Recovery Mode with spctl command can be explored (See Related Content).
• The --skip-kext-approval-check switch is not compatible with macOS Sensor installer versions lower than 3.1.x.x.