Agent Enforcing Execution Block For User in Specified Group At Logon

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Execution Block on login scripts where a Group s are selected as the applicable target.
• Execution Block of software that loads very early in the boot process.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Cause

There is a brief delay after a user logs in before group membership is established. This delay will also delay when group-based rules become effective. This delay may be longer if the Agent has a large number of rules to expand.

Resolution

If a rule must be effective as soon as possible after a user logs on, do not specify a Group in the rule. Rules that specify a Username or SID are always active and won't be affected by this delay.

Additional Information

• In some instances the Rapid Config for Domain Logon Scripts may help alleviate these blocks.
• More information on specifying Users or Groups can be found in the User Guide chapter Custom Software Rules.
• See also the Custom Rules Best Practices guide.