Banned Publisher is Allowed To Execute

Products

• Carbon Black App Control

Issue/Introduction

After banning a publisher, the files are still able to execute in the environment. 

Environment

• Carbon Black Application Control: All Versions

Cause

Incorrect publisher is banned or policy is not set to enforce banning

Resolution

1. Check that the policy the machines are in have publisher banning enabled. 
   1. Log into the console
   2. Go to Rules > Policies
   3. Select the policy the example machine is assigned into. 
   4. Select the "Advanced" tab
   5. Validate that "Block files with banned publishers or certificates" is set to Active. 
   6. If it's not set to active, change the status and save the policy. 
2. Double check the publisher name of the file matches exactly the name of the banned publisher.
   1. In the console, add the column "File Publisher" and filter for the file that was allowed. 
   2. From the endpoint side validate what the Agent has for the publisher name and status. 

      cd "C:\program files (x86)\bit9\parity agent\"
      dascli password <global password>
      dascli find <path to executed file> 

Additional Information

 A small change in publisher name can make the difference. Example "Carbon Black Inc." vs "Carbon Black, Inc." would not be the same publisher due to the mismatch in publisher name with one version having a comma.