App Control: Duplicate Approval Requests Seen In Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Multiple old approval requests re-created from some endpoints and showing in console

Environment

• App Control Server: All Supported Versions
• App Control Console: All Supported Versions

Cause

• Old Computer Cleanup was set, which caused offline endpoint data to be purged after a set period of time
• When the endpoints came back online, the data synced up again to the App Control Server, including the original approval requests
• Known Issue: EP-8893

Resolution

First Option

1. Disable or tune Old Computer Cleanup settings
2. Go to "System Configuration > Advanced Settings" to prevent zero prevalence pruning from occurring on endpoints that are still active, but may go offline

Second Option

1. Open a ticket to Support Team and request the CreateApprovalRequest.sql script before each additional step
2. Ensure there is a full backup of the das database before proceeding
3. Create a back up for dbo.CreateApprovalRequest.sql store procedure
4. Stop App Control Services (Reporter and Server)
5. Open SQL MGMT Studio
6. Expand Databases > das > Programmability > Stored Procedures
7. Delete the old dbo.CreateApprovalRequest.sql procedure
8. Create the new store procedure using the sql script provided by Support
9. Verify the new Store Procedure
10. Start Server and Reporter Services