Carbon Black Cloud Enterprise EDR: Sensors fail to communicate via proxy when a user is not logged onto an endpoint

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Sensor configured to use a proxy
• Sensor fails to communicate to the backend while a user is not actively logged onto an endpoint

Environment

• Carbon Black Cloud Console: All Versions
•  Carbon Black Cloud Enterprise EDR Sensor: 3.4.x.x and higher
• Microsoft Windows: All Supported Versions

Cause

A sensor installation script is used that leverages user impersonation

Resolution

1. Uninstall the sensor on the affected endpoint
2. Modify the install script to remove user impersonation
3. Reinstall the sensor on the affected endpoint
4. Validate the sensor is able to communicate successfully to the backend from within the Carbon Black Cloud console when a user is not logged onto the endpoint

Additional Information

A future product enhancement will add functionality to allow modification of proxy settings via the RepCLI utility to prevent uninstalling/reinstalling the affected sensor(s)