macOS Sensor installed with a status of "Sensor Bypass Admin Action"

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Once registered, the Endpoints Page shows "Sensor Bypass Admin Action"
• All efforts to take the sensor out of bypass fail.

Environment

• Endpoint Standard (Formerly CB Defense) Sensor: All Versions
• Apple macOS: Mac OS 10.13.0 and Higher
• Unattended install method used to install Sensor on macOS

Cause

• The kernel extension (Kext) may not approved by the end user
• The sensor may be incompatible with that specific Operating System.
• It is possible that error 603946981 may be observed

Resolution

1. Check for issues with KEXT approval.
   
   
   1. On the Inventory > Endpoints page of the Web Console search for "sensorStates:DRIVER_INIT_ERROR" to find all sensors that have not been KEXT approved.
   2. Sensor KEXT can then be locally approved by the end user in System Preferences > Security & Privacy. See How to approve Mac Sensor 3.0 KEXT for Install/Upgrade
   3. The sensor status will change to "Active" within 30 minutes of KEXT approval.
   4. If the approval request has timed out, the installer needs to be run again to trigger the request message. See Apple Technical Note TN2459 for more details and recommendations for enterprise environments. 
      
      
2. Check for unsupported Operating System.

1. 1. On the Inventory > Endpoints page of the Web Console search for "sensorStates:UNSUPPORTED_OS" to find all sensors that are unsupported on a specific OS.
   2. Make the necessary changes by uninstalling the current incompatible sensor and install a compatible sensor.

Additional Information

1. If the above A and B options do not work then reach out to Carbon Black Support via creating a case in the Support Portal.
2. If a customer is unable to create a Support case, contact the Global Customer Assistance team.