Specifying Local Users in a Custom Rule

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When saving a Custom Rule with a local user, the following error is returned:

SID for 'LOCAL\USER' was not found: Some or all identity references could not be translated.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

The only local users that can be included by name in a Custom Rule are the generic users such as Local Administrator or Local System. To specify a specific, local user, enter the SID for that user directly in the field.

Additional Information

• On Windows the wmic useraccount command can be used in a command prompt, example:

  wmic useraccount where name='Specific Account' get domain,name,sid

• More information on Specifying Users can be found in Server Documentation > version > User Guide > Custom Software Rules > Specifying Users or Groups.