Carbon Black Cloud: How to Troubleshoot GPO Sensor Installations

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to troubleshoot if Group Policy installs of the sensor are not working

Environment

• Carbon Black Cloud Windows Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Enable MSI Logging via GPO in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Configure-GPO-to-Create-Sensor-MSI-Log/ta-p/43973
2. Review Microsoft documentation on deploying via GPO like https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/use-group-policy-to-install-software to confirm GPO is setup correctly
3. Review the system event log after reboot for group policy events with error codes like %%1274 to review why GPO is failing to push the sensor install
4. Check the application event log for msiinstaller events on the system after reboot to confirm if the install is actually failing and if so gather/check the install logs