CB Protection: Will Re-enabling Agent From Services Menu an Agent Approve New Files?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

If a CB Protection Agent service is set to 'Disabled' in the services.msc menu for an extended amount of time, will re-enabling the Agent discover any new files introduced to the machine?

Environment

• CB Protection Agent: All Versions
• Microsoft Services menu (services.msc)

Resolution

When the CB Protection Agent is set back to 'Enabled' from the services.msc menu, the Agent WILL NOT automatically check/approve any new files introduced to the machine while the Agent was disabled.
 

Additional Information

• Running a Cache Consistency Check on the Agent with the 'Full Scan for New Files' option checked would be the supported method for checking/approving files introduced to the machine while the Agent was 'Disabled' in the services.msc menu.
• New files introduced to the machine while the Agent was disabled will only be checked/approved when certain FileOps are performed on the file(s), (e.g., execute, write).