Carbon Black Cloud: Unable to Run RepCLI With Error: You are not authorized to run this command

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

RepCLI displays the following message:

Error: You are not authorized to run this command Command failed.

The sensor logs will show something similar to the message below, in this case, after running "repcli ondemandscan [path]":

MM/DD/YY HH:SS:00.000: 50a8 ERROR DebugPortServer::AuthenticateRequest: Process[22680] is not authenticated. CLICommand[OnDemandScan] rejected
MM/DD/YY HH:SS:00.000: 50a8 ERROR DebugPortServer::HandleDebugRequest: Denied attempt to run authenticated CLI Command[OnDemandScan] by ProcessId[22680]

Environment

• Carbon Black Cloud Sensor: 3.3 and Higher
• Microsoft Windows: All Supported Versions

Cause

The command failed as some RepCLI parameters require authentication

Resolution

Either the user's Windows Security Identifier (SID) or the user's group SID must be added to cfg.ini (this can be done at install, see KB below for more information.

Additional Information

For more information on Microsoft Windows' security identifiers, please see Microsoft's KB in "Related Content" section below.