Mac Endpoint in "Bypass", even after all manual approval steps in documentation are followed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

After installing 3.8.0.58 sensor on a 14.5 macOS endpoint without MDM approvals, the sensor remains in Bypass or a FDA Error status, despite following all steps in Documentation here.

Environment

• Carbon Black Cloud Sensor: 3.8.0.58 and Higher
• Apple MacOS:12.7 and Higher

Cause

com.vmware.carbonblack.cloud.se-agent.extension was not granted Full Disk Permission during sensor installation. 

Resolution

1. Navigate to System Settings > Privacy & Security > Full Disk Access
2. Toggle the com.vmware.carbonblack.cloud-se-agent.extension entry to enabled.
3. Change will require credentials.
4. In addition drag-and-drop the entire /Applications/VMware/Carbon Black Cloud/repmgr.bundle from the Finder window to the Full Disk Access pane similar to step 5 of the FDA documentation. 

Additional Information

• Moving the entire repmgr.bundle from to Full Disk Access will not display any indication that it was done but will still work.
• It may still take a reboot or 15 minutes to an hour for FDA warnings or errors to go away once this has been completed.
• If needed so a clean install can be done the MacOS Sensor can be uninstalled following these steps.
• If terminal is given FDA access then the following can be used check if the correct permissions were given
  • Run the command

    sqlite3 /Library/Application\ Support/com.apple.TCC/tcc.db 'select * from access' | grep com.vmware.carbonblack.cloud.daemon

  • Incorrect permissions will display

    com.vmware.carbonblack.cloud.daemon|0|0|5|1|??

  • Correct permissions will display

    com.vmware.carbonblack.cloud.daemon|0|2|4|1|??