Endpoint Standard: Mac Sensor installs with status "Sensor Bypass Admin Action"
Environment
Endpoint Standard (Formerly CB Defense) Sensor: All Versions
Apple macOS: Mac OS 10.13.0 and Higher
Unattended install method used to install Sensor on macOS
Symptoms
Once registered, the Endpoints Page shows "Sensor Bypass Admin Action"
All efforts to take the sensor out of bypass fail
Cause
The kernel extension (Kext) is not approved by the end user
It is possible that error 603946981 may be observed
Resolution
In the Sensor Management page of the Web Console searching for sensorStates:DRIVER_INIT_ERROR to find all sensors that have not been KEXT approved. See https://community.carbonblack.com/docs/DOC-9885
The sensor status will change to "Active" within 30 minutes of KEXT approval.
If the approval request has timed out, the installer needs to be run again to trigger the request message. See Apple Technical Note TN2459 for more details and recommendations for enterprise environments.
Additional Notes
Secure Kernel Extension Loading was introduced with macOS 10.13 High Sierra.