Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Not All Policies Generating Agent Installers

App Control: Not All Policies Generating Agent Installers

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions

Symptoms

  • Not all Agent install packages are being generated.
  • Manual regeneration of the installers does not update any packages.
  • Console Host Package Page shows an outdated Date Modified timestamp.
  • Agent install files in "C:\Program Files (x86)\Bit9\Parity Server\Hostpkg" are outdated.
  • Files exist in the 'C:\Program Files (x86)\Bit9\Parity Server\hostpkg\temp' folder.

Cause

The cause of this is a "stuck" or otherwise corrupted temp file. When the Server attempts to build new Agent Install Packages, it halts, waiting for the previous file to be removed which either fails to complete or remains in an otherwise stuck state.

Resolution

  1. Login to the application server as the Carbon Black Service Account.
  2. If an Agent is installed, temporarily disable Tamper Protection
  3. Stop the Carbon Black App Control Server and Reporter services.
  4. Delete any files that exist in C:\Users\<ServiceAccountName>\AppData\Local\Temp\
  5. Delete any files that exist in C:\Program Files (x86)\Bit9\Parity Server\hostpkg\temp\
  6. Delete only outdated installers that match Policy names in C:\Program Files (x86)\Bit9\Parity Server\hostpkg\
  7. Start the Server and Reporter services.

Additional Notes

  • Agent Install Package generation should automatically begin shortly after the services are restarted.
  • In some instances the Agent Host Package Installer may need to be re-applied following these steps.
  • Manual Package Regeneration can be initiated following these steps.

Related Content


Labels (1)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎11-08-2022
Views:
617
Contributors