Choose: Show Filters > Add Filter > Value > contains:ignore_partial_chain_on_countersignatures
Click the pencil icon on the resulting Agent Config and change the Value to: ignore_partial_chain_on_countersignatures=1
Allow the agents some time to receive the updated CL Version and to run a CC check to approve the files that were previously signed by trusted publisher, but their approvals failed due to countersignature error
Note: This setting will require the Agent to run a Cache Consistency Check so existing files can be analyzed and issued Approvals according to the new setting.
In order to maintain the highest security posture, Carbon Black strongly recommends pushing out the missing certificates in the chain, as described here.
Although this setting is not recommend, it's been created to help facilitate Publisher Approvals in environments where the Counter Certificate Chain is incomplete and can not easily be fixed.
This Agent Config was made available with the release of Server & Agent version 8.1.4.