Install or Upgrade the Rules, Agent, or Kernel Mod Installers

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps on how to install or upgrade the Rules Installer, Agent Host Package Installer, or Kernel Module Installer on the App Control Server.

Environment

• App Control Console: All Supported Versions
• Rules Installer: All Supported Versions
• Agent Installer: All Supported Versions
• Kernel Module Installer: All Supported Versions

Resolution

Remotely via the Console:

Attention: During upload the Server will require full validation of the certificates associated with Agent/Rule Installers. If validation errors are encountered, follow the steps here. When a Group Managed Service Account (gMSA) is in use for App Control, this method will not work.

1. Download the latest Rules, Agent or Kernel Module Installer.
2. Extract the executable from the zip.
   

   Example Filename: MacHostPackageInstaller_VERSION.exe

3. Log in to the Console and navigate to: Settings (gear icon) > Update Agent/Rule Versions.
4. Drag and drop (or browse to) the extracted executable.
   • Do not navigate away from the Update Agent/Rule Versions page while uploads are processing.
5. Confirm the relevant Installer has updated by navigating to: https://ServerAddress/InstallerVersions.php

Locally on the Application Server:

1. Log in to the application server as the Carbon Black Service Account.
   IMPORTANT: The install will fail if not ran as the Carbon Black Service Account.
2. Manually install the necessary certificates.
3. Download the latest Rules or Agent installer and extract the executable from the zip:
   

   Example Filename: MacHostPackageInstaller_VERSION.exe

4. Right click the exe > Run as administrator

When Using a gMSA:

When a Managed Service Account is being used for the App Control Service Account the following steps are required:

1. Verify the necessary certificates are installed on the application server hosting the Console.
2. Download PsExec from Microsoft.
3. Execute the following command, referencing the gMSA accordingly:

   PsExec.exe -u domain\gmsa_account$ "C:\Path\To\WindowsHostPackageInstaller_VERSION.exe"

Additional Information

• Troubleshooting Failed Install of Agent, Rules, or Kernel Module Installers
• When a new Agent Host Package installer is uploaded to the Server:
  • The App Control Server service will be restarted and the Console will temporarily be unavailable.
  • The current Configlist Version is written to the Shepherd Config MinConfigListVersionForUpgrade
• If using Unified Management to manage multiple App Control Servers:
  • New Rule and Agent Installers must be uploaded to each server separately.
  • The Management Server does not broadcast these packages to the Managed Servers.