Move Agent In/Out of Local Approval
search cancel

Move Agent In/Out of Local Approval

book

Article ID: 286576

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to move an Agent in or out of Local Approval.

Environment

  • App Control Console: All Supported Versions
  • App Control Agent: All Supported Versions

Resolution

Connected Agents:

Moving Into Local Approval Mode:

  1. Log in to the Console and navigate to Assets > Computers.
  2. Locate the relevant Computer(s) and check the box next to the name.
  3. From the Action menu choose: Move to Local Approval.

Moving Out of Local Approval Mode:

  1. Login to the Console and navigate to Assets > Computers.
  2. Locate the relevant Computer(s) and check the box next to the name.
  3. From the Action menu choose: Restore to Normal Enforcement Level.

Disconnected Agents:

There are multiple ways to move a disconnected Agent into Local Approval:

Additional Information

  • Local Approval is a special Policy that is not editable.
    • Settings that are Policy Specific, will not apply (ex: Custom Rules, Agent Configs, Kernel Exclusions, etc).
    • Device Controls are set to Off (no blocking, no reporting) while in Local Approval.
  • Events captured while in Local Approval will be reported under the Policy, "Local Approval Policy".
  • An Event Rule can be created to automatically Restore Normal Enforcement of Connected Agents in Local Approval.
  • Moving an agent into and out of local approval will create events with the Type "Computer Management" and Subtype "Agent Policy Changed".