App Control: Active Directory Integration Unable to Map- Displays '201'

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

"201" prefixes show for LDAP queries within the App Control console

Environment

• App Control Server: All Supported Versions
• App Control Console: All Supported Versions
• Active Directory Integration Enabled

Cause

Shepherd Configuration ScriptDebugLevel not reverted after logs collected
OR
Script Debugging levels set to high manually on the database script files (ex: adrules.xml) and not reverted after log collection completed

Resolution

Check that the Shepherd Configuration is correctly set:

1. Navigate to https://<yourservernamehere>/shepherd_config.php
2. Find the property named ScriptDebugLevel
3. Set the value to 0
4. Click on Change
5. Find the property named DebugLevel
6. Set the value to 0
7. Click on Change
8. Logout of the console
9. Log back in as Administrator and validate if these changes resolved the issue

If the steps above do not resolve the issue, the debug level may have been manually changed in any one of the Parity Server script files. Instead of manually searching each file for the error, it is advised to replace the full set of scripts with a copy of the entire folder from a fresh installation of the same App Control Server version

NOTE: The steps below would be best done outside of business hours as it requires a restart of the App Control services

App Control server keeps a copy of the .vbs scripts in SQL and replaces them on first request.  For some of the items in the scripts folder 'first request' is at server start up. Since the scripts are cached in the database, the steps below need to be followed in strict order

1. Back up everything in the scripts folder to another location. Script folder location:

   C:\Program Files (x86)\Bit9\Parity Server\scripts\

2. Replace the scripts folder with the copy of the scripts folder from a fresh installation of the same App Control Server version
3. Restart the Reporter and Server services. 
4. Login using AD, or use the testlogin page by browsing to https://YourCbServerName/testlogin.php. Enter a test Active Directory account and their password.  Click Test Login. 
5. Confirm the issue with "201" prefixes on LDAP queries is resolved.

Additional Information

• Server has historically had versions earlier than 8.0 running or changes made to debug levels in the App Control database scripts
• The steps listed in resolution for editing the scripts folder isn't common unless the server was established before the debug settings were available to be adjusted in the console 
• Previous to the in console settings, the scripts would be manually changed to capture high debug logs for all support cases