Environment
- Carbon Black Cloud Workload: Windows Sensor 3.9.1 and Older
Symptoms
- "Verification Failed. Possible Tampering Detected" listed in the Install Status field post install
- VMware vSphere Status: Install Error
Cause
An expired certificate causes the MSI signing check to fail.
Resolution
Any of the below methods can be used to get the sensor to install
- Manually install sensor on endpoints
- Use methods for deploying sensor with 3rd party tools
- Install using the 3.9.1.2691 or later sensor version
- VMware Tools 12.2.5 will prevent this error (released June 13th, 2023)
Additional Notes
- This issue began after the expiry of the CarbonBlack certificate used to sign the sensor MSI installer on 11th May 2023.
- In the CWP sensor installation workflow, after downloading the sensor MSI on the system, an attempt to validate the MSI signing certificate fails due to the expired certificate check in CbLauncher and as a result sensor installation fails.
- Review KB on How to view Digital Signature of CB installer and check for "Valid to" date to see if it expired in May of 2023.
Related Content
