App Control: Health Check Id 595 "Carbon Black App Control Agent is allowed to be stopped"

[#1]

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Question

What causes the Health Check for FailureId[595]

Carbon Black App Control Agent is allowed to be stopped Reasons [0008:UpgradeAllowed]

Answer

This failure is due to an Agent Config designed for Agent Upgrades via third party tools (SCCM) being enabled. If Agent Upgrades are not taking place it is recommended to disable this Agent Config:

1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
2. Add a filter > Value > contains: allow_upgrade > Apply.
3. Edit (pencil icon) the relevant Agent Config and either disable it or change the Value to:

   allow_upgrade=0

4. Verify the Agent receives the change, then run a new Health Check.

Additional Notes

• There are many ways to enable or disable Tamper Protection: Global, Policy, Agent.
• The Agent Configs can be found by navigating to: https://ServerAddress/agent_config.php

Related Content

App Control: How to Disable/Enable Tamper Protection
App Control: Tamper Protection Not Being Enforced
App Control: Where Can I Find the Health Check Event Guide?