Using Timed Override To Move Agent Into Local Approval

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to move an Agent into Local Approval via Timed Override.

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions

Resolution

1. Log in to the Console and navigate to Assets > Computers > relevant Computer.
2. From the Computer Details page, click the 'Policy Override' tab.
   • Verify, "Temporary Enforcement" is set to Local Approval.
   • Specify the length of time (in minutes) the Enforcement Level will remain active.
   • Specify the length of time the Code will remain valid.
   • Click, "Generate Code".
3. On the endpoint:
   • For a Windows Endpoint open a Command Prompt and enter the following commands:

     cd "C:\Program Files (x86)\Bit9\Parity Agent\"
     
     TimedOverride.exe <CODE Here without brackets>
     

   • For a macOS endpoint, open Terminal and enter the following commands:

     cd /Applications/Bit9/Tools/
     ./b9cli --timedoverride CODE

   • For a Linux endpoint, open Terminal and enter the following commands:

     cd /opt/bit9/bin/
     ./b9cli --timedoverride CODE

Additional Information

• TimedOverride.exe must be executed locally on the endpoint.
• The Timed Override code is specific to the Agent it was generated for, and the codes are not interchangeable between Agents.
• The Timed Override version of Local Approval will inherit the Device Control settings of the Policy the Agent is in.
• The Agent will remain in a Disconnected state until the expiration of the Timed Override. Rebooting the endpoint will not restore connectivity.