Move Agent In/Out of Local Approval

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to move an Agent in or out of Local Approval.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

Connected Agents:

Moving Into Local Approval Mode:

1. Log in to the Console and navigate to Assets > Computers.
2. Locate the relevant Computer(s) and check the box next to the name.
3. From the Action menu choose: Move to Local Approval.

Moving Out of Local Approval Mode:

1. Login to the Console and navigate to Assets > Computers.
2. Locate the relevant Computer(s) and check the box next to the name.
3. From the Action menu choose: Restore to Normal Enforcement Level.

Disconnected Agents:

There are multiple ways to move a disconnected Agent into Local Approval:

• Using Timed Override To Move Agent Into Local Approval
• Change Enforcement Level (Locally)

Additional Information

• Local Approval is a special Policy that is not editable.
  • Settings that are Policy Specific, will not apply (ex: Custom Rules, Agent Configs, Kernel Exclusions, etc).
  • Device Controls are set to Off (no blocking, no reporting) while in Local Approval.
• Events captured while in Local Approval will be reported under the Policy, "Local Approval Policy".
• An Event Rule can be created to automatically Restore Normal Enforcement of Connected Agents in Local Approval.
• Moving an agent into and out of local approval will create events with the Type "Computer Management" and Subtype "Agent Policy Changed".