Cb Protection: Why am I getting tamper protect blocks?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why am I getting tamper protect blocks in my environment?

Environment

• Cb Protection: All Supported Versions

Resolution

Tamper protect blocks are caused by unauthorized attempts to modify or access the agents files, folders, services, processes, or registry keys.

Additional Information

• Tamper protect can not be bypassed by any rules or approvals, it can only be disabled or enabled.
• Best course of action is to exclude CB Protection files and processes from the software(s) attempting to access and/or make changes.