Carbon Black Cloud Enterprise EDR: Sensors fail to communicate via proxy when a user is not logged onto an endpoint
book
Article ID: 289451
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Sensor configured to use a proxy
Sensor fails to communicate to the backend while a user is not actively logged onto an endpoint
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Enterprise EDR Sensor: 3.4.x.x and higher
Microsoft Windows: All Supported Versions
Cause
A sensor installation script is used that leverages user impersonation
Resolution
Uninstall the sensor on the affected endpoint
Modify the install script to remove user impersonation
Reinstall the sensor on the affected endpoint
Validate the sensor is able to communicate successfully to the backend from within the Carbon Black Cloud console when a user is not logged onto the endpoint
Additional Information
A future product enhancement will add functionality to allow modification of proxy settings via the RepCLI utility to prevent uninstalling/reinstalling the affected sensor(s)