Config List initializes at version 0 after installation of App Control Agent

Products

• Carbon Black App Control

Issue/Introduction

After regenerating agent packages (commonly following a CA certificate renewal), newly installed Windows agents initialize with a Config List version (CLVer) of 0. This prevents the agent from using the "baked-in" configuration, forcing a full incremental synchronization from the server that can take 24–48 hours in case of CL versions above 1 million.

Symptoms:

• Agent initializes with CLVer = 0.
• Agent logs show: InitCache: ImportErrors[1] or Cache::ValidateConfigListFile Error: Decrypting the file seccon2.bt9 failed with error: [Bad Data].
• Endpoints experience enforcement gaps or unnecessary blocks during the extended synchronization period.

Environment

• App Control Server: 8.12.x
• App Control Agent: 8.10.x, 8.11.x
• OS: Windows

Cause

This is caused by a known defect (CRE-23916) where the agent fails to successfully import the embedded Config List file during the initial installation phase.

Resolution

 Fixed in App Control Server version 8.13 and Agent version 8.12.

For environments unable to upgrade their agents to 8.12 immediately, follow these steps:

1. Upgrade server to 8.13 and then navigate to https://####/shepherd_config.php on the App Control Server.
2. Add or modify the following property:
   • Property: UseEncryptedConfigListInWindowsPackages
   • Value: true
3. Regenerate the agent installation packages.
4. Alternatively, use the manual import workaround documented in KB 288532.

Additional Information

Users are recommended to subscribe to this article for further updates regarding this defect.