Carbon Black Cloud: Sensor Install Suddenly Failing on all Devices

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Sensor installation was working with no issue
• Installation started to fail after reaching 100 Active Sensors
• No changes have been made to Carbon Black Cloud Console
• New Company Code has not been generated

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

• Trial limit of 100 Sensors has been reached
• Error message for Windows devices report that the org was still in trial mode so the sensor exceeded the max user license allowed
  • %TEMP%\confer-temp.log (3.4.x.x and earlier)
  • %TEMP%\cb-installer-<Version>.log (3.5.x.x and higher)

    ParseReplyHeader: Server returned error 0x64:Unable to register this device Max (100) registered devices allowed during trial

• Error message for Linux devices report that the org was still in trial mode so the sensor exceeded the max user license allowed
  • /var/opt/carbonblack/psc/log/log.txt

    PscComms::MessageTransactorV1 : MessageTransactionReply : Server reported an error. MsgId: 4098. Code: 100, msg:Unable to register this device: Max (100) registered devices allowed during trial.

Resolution

• If CB Defense has already been purchased, contact Carbon Black Sales to ensure org is transitioned from Trial to Paid
• During Trial/Eval/POC period there is a licensing hard limit of 100 Sensors

Additional Information

• The confer-temp.log or cb-installer-<Version>.log can be found in one of the locations listed below depending on how the sensor was installed:

Windows
C:\Users\<user>\AppData\Local\Temp\
C:\Windows\TEMP\
C:\Users\All Users\AppData\Local\Temp

MacOS
/tmp
/Applications/Confer.app/