CB Protection: Trusted User Still allowed and approved even after removal

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Trusted user still trusted after logging off, removal of trust and logging back on

Environment

• CB Protection Agent: All Versions
• Microsoft Windows: All Supported Versions

Cause

• From the CB Protection User Guide:

  When a trusted user logs off of a computer, sessions the user initiated may be cached by the operating system. When that user logs in again, trust privileges could continue, even after being disabled  through the console. 
  It might be necessary to reboot a system to remove user trust from all processes.

Resolution

1. Reboot agent after removing Trusted User status as this is a limitation of the Operating System.