App Control: Server Services Missing After Reboot

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• After reboot the App Control Server and Reporter services are missing in the Services console (services.msc)
• Console unavailable due to Fatal Error: The Carbon Black App Control Console cannot connect to the database
• App Control Server has been uninstalled/re-installed
• App Control Agent is present on the same system as the App Control server app
• Rules Installer versions 1.10 to 1.14 have been added previously

Environment

• App Control Server: All Supported Versions
• App Control Rules Installer: 1.10 -1.14
• Windows Server: All Supported Versions

Cause

There was an issue introduced in the Rules Installer v1.10 that caused the Agent's Tamper Protection to prevent a clean uninstall of the App Control Server, leaving behind a "Delete" registry flag. Subsequently, the OS will delete the services after reboot which causes the App Control Server failure.

Resolution

1. Uninstall/Re-install the App Control Server application.
2. Install the latest Rules Installer.
3. Next either:

• Apply the registry fix available HERE
• Manually delete the following registry values if they exist:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParityServer\DeleteFlag
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParityReporter\DeleteFlag

• If the issue hasn't been resolved, run this command as admin to register the service:

  "C:\Program Files (x86)\Bit9\Parity Server\parityserver.exe" /register /dsn "C:\Program Files (x86)\Bit9\Parity Server\shepherd.dsn"

Additional Information

This issue EP-15460 has been resolved in the Rules Installer v1.16 per release notes