Console Inaccessible "Your Demo of Carbon Black App Control has expired"

Products

Carbon Black App Control

Issue/Introduction

This guide covers all known causes and solutions for the "Your demo of Carbon Black App Control has expired" error (which often prevents login or causes a login loop) in Carbon Black App Control (formerly Cb Protection).

Your Demo of Carbon Black App Control has expired. Contact Global Customer Assistance to purchase a copy.

Environment

App Control Server: 8.11.x or Higher

Cause

The Server License file was already expired before the upgrade to Server 8.11.0
There is an DNS issue resolving the Web Server Address to the correct IP address
There is an IIS error or misconfiguration
Missing permissions for the Machine Keys folder

Resolution

Cause # 1: The Server License is Expired

This is the most common cause, particularly if you recently upgraded your server to version 8.11.x or higher and the license was already expired prior to the upgrade.

Log in to the Broadcom Support Portal and download your current Server License. (Note: The Serial Number and CDC Activation Key are not the license; the actual license is a long encoded string).
Stop the App Control Server and App Control Reporter services.
Open your downloaded .lic file in a text editor and copy its contents.
Run SQL Server Management Studio as the Carbon Black Service Account.
Execute the following SQL query, pasting your license string inside the single quotes:
```
USE das; 
EXECUTE dbo.UpdateLicense 'PASTE_YOUR_LICENSE_VALUE_HERE', '0'
```

Important: If your current license is unavailable for download, call GCA and/or open a non-technical case with Broadcom for License Related Issues.

Only the non-technical GCA team can assist with licensing.
If your system is down due to an 8.11+ upgrade, you may need to uninstall, restore your pre-upgrade database, and reinstall the older version while waiting for support.

Cause # 2: DNS Resolution Issues

The App Control server validates the license by making an internal API call to the Web Server Address stored in the database. If this fails to resolve properly for both IPv4 and IPv6, the license check fails.

Open SQL Server Management Studio as the Carbon Black Service Account.

Check the configured Web Server Address:

USE das;
SELECT value FROM shepherd_configs (NOLOCK) WHERE name = 'WebServerAddress'

If the name is incorrect, update it:

USE das;
EXEC dbo.updateshepherdconfig @name = 'WebServerAddress', @value = 'YourAppCServer.example.com';

Ensure DNS resolves this address to your server's local IPs, or force it by editing your HOSTS file (C:\Windows\System32\drivers\etc\hosts) as Administrator and adding:
```
127.0.0.1 YourAppCServer.example.com
::1 YourAppCServer.example.com
```
Ping the address (ping -4 and ping -6) to verify it connects locally.
Validate the settings by pinging the Web Server Address:

Cause #3: IIS Web Server Misconfiguration

If the license is valid but the API call fails, it may be due to a misconfiguration in IIS.

Open the \Bit9\Parity Console\WebUI\Logs\php_errors.log in a text editor.
Search for 'login.php'.

Common error codes & Solutions:

HTTP Code 401 (Unauthorized): Anonymous Authentication has likely been disabled. Re-enable Anonymous Authentication.

API Error from page /login.php: GET appc.example.com/api/bit9platform/restricted/licenseUsage/ with params [] 
.....
returned http code 401 and result in 0.0067501068115234 seconds

HTTP Code 0 (Empty reply):Usually indicates a deeper IIS configuration error. Reinstalling IIS may be necessary.

API Error from page /login.php: GET appc.example.com/api/bit9platform/restricted/licenseUsage/ with params [] 
.....
http code 0 and result  in 0.37768602371216 seconds
Last Curl error: Empty reply from server

HTTP Code 500: Has many potential culprits. Confirm Permissions are correct, the IIS Identity is correctly set, or missing dependency requiring an IIS reinstall, example:

API Error from page /login.php: GET appc.example.com/api/bit9platform/restricted/licenseUsage/ with params [] 
.....
http code 500 and result in 0.13003587722778 seconds

Cause #4: Incorrect MachineKeys Folder Permissions

If your license is valid but you still get the error (and your php_errors.log shows a 401 error for licenseUsage), the service user account may lack permissions to the MachineKeys folder. This often happens after changing the service user account.

Open Command Prompt as Administrator.

Apply Microsoft's default permissions to the folder by running:

icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" /grant "Everyone":(NP)(RX,W,RC)

Restart the Carbon Black Application Control Server service and refresh the console.
If the issue persists (Targeting the specific key):
1. Download and open Procmon (from Microsoft Sysinternals).
2. Set a filter where Result is "Access Denied" and Process Name is "parityserver.exe".
3. Start the capture, restart the Carbon Black Server service, and refresh the console.
4. Note the specific file path in the MachineKeys folder throwing the "Access Denied" error.
5. In an Administrator Command Prompt, take ownership of that specific file:
```
takeown /F "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\YOUR_KEY_FILE_NAME"
```
6. Grant read permissions to your service account:
```
icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\YOUR_KEY_FILE_NAME" /grant "DOMAIN\service_account":(R)
```
7. Restart the service and refresh the console.

Still having issues?

Collect the latest Server Historical Logs (locally).
Collect the latest Database Performance Logs.
Open a Technical Support Case and provide the captured logs.