How to Configure the repCLI Authenticated Users in VMware Carbon Black
Summary: This article describes how to edit the AuthenticatedCLIUsers option to enable or modify the set of authenticated users for the repCLI tool.
Instructions
Affected Products:
- VMware Carbon Black
Some repCLI commands can only be run if the logged in user is part of the repCLI authenticated users. To be part of the authenticated users the SID of the specific user, or group containing the specific user, must be set in the AuthenticatedCLIUsers option present in the Carbon Black cfg.ini file.
It is possible to find the SID of the current user or group to add, by running whoami /all in the Windows command prompt.
Figure 1: (English Only) Administrator: Windows PowerShell
There are two methods to set the AuthenticatedCLIUsers SID:
- During the installation - using the command-line switch
- After installation: Online - using the cfg.ini file
To add the SID of a user or a group to the authenticated users during the setup of the sensor, it is necessary to specify the switch CLI_Users=sid in the install command as in the example below:
msiexec/q /i C:\temp\installer_vista_win7_win8-xx-y.z.t.q.msi /L* log.txt COMPANY_CODE=XYZ CLI_USERS=S-1-2-………
To add the SID of a user or a group to the authenticated users, after the initial setup, it is necessary to enable bypass mode on the Sensor to be able to edit the cfg.ini file.
Follow the steps below to enable the Bypass mode and to modify the cfg.ini file:
- Connect to the VMware Carbon Black Cloud console and go to the Endpoints.
- Enable bypass mode on the Endpoint on which the cfg.ini file to be modified is located.
- On the endpoint, go to C:\Program Files\Confer and make a backup of the cfg.ini file.
- Open the cfg.ini file with Notepad.
- Add or modify the following line specifying the SID of the user or group to be authenticated.
AuthenticatedCLIUsers=<SID>
- Select the Save option in Notepad and close it.
- Load the updated configuration using the RepCLI command.
c:\program files\confer\repcli" updateconfig
- Disable the bypass using the RepCLI command.
c:\program files\confer\repcli" bypass 0
repcli bypass command completes successfully only if the SID Authentication is correctly enabled for the logged user.
To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.