App Control: Agents Suddenly Changed Enforcement Level From High to Low

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

The Enforcement Level for all Agents suddenly changed in the Console from High to Low.

Environment

• App Control Agent: All Versions
• App Control Server: All Versions

Cause

Enforcement Level for the Policy of the effected Agents was unknowingly modified.

 

Resolution

1. Change 'Connected' Enforcement Level of Policy back to 'High (Block Unapproved)'

Additional Information

• Perform following steps to locate Event where Policy was modified, and User who performed modification

1. Open Console -> Reports -> Events screen
2. Select 'Show Filters', add following filter: Subtype is Policy modified
3. Select 'Show Columns', add 'User' column
4. Select Apply
5. Adjust 'Max Age' to locate 'Policy Management' Event