Sensor fails to update policy after change hint applied in Carbon Black Cloud Console

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Container
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload

Issue/Introduction

A sensor might show a grayed out policy name for the newly applied policy in the Carbon Black Console.

Environment

• Carbon Black Cloud Console: Current Version
• Carbon Black Cloud Windows Sensor: All Versions
• Microsoft Windows OS: Supported Versions

Cause

 The Carbon Black Cloud backend will create the hint for the policy change and show that new policy as grayed out in the console view, but the sensor never gets the hint to change policy and stays in the original policy.

Resolution

1. From the Carbon Black Cloud Console, select the problem endpoint from the Inventory > Endpoints page
2. Click "Take Action" > "Assign Policy" and apply original policy back to the endpoint (can also choose any other policy like "Standard")
3. Once the sensor has a successful check-in and moves into the chosen policy from Step 2, this validates the sensor is picking up policy hints successfully
4. Try to move the sensor into the desired policy once again and validate the sensor now moves into the correct policy on its subsequent check-in.