File initialization is the file inventory process that begins immediately after installation of the Carbon Black App Control Agent on a computer.
The agent takes an inventory of all executable files on the client computer’s fixed, local drives and creates a hash of each file. When a computer first connects to the server, its agent sends each hash to the Carbon Black App Control Server to update the server’s file inventory. Files that exist on a computer at initialization receive a local state of Approved unless they already have been identified and globally banned or banned by policy on the Carbon Black App Control Server.
In the Files on Computers table, when Show individual files is not selected, each agent-managed computer has a row with the file name <Initialization files>.
Clicking <Initialization files> in a row opens a table showing all initialized files for one computer. This is a useful way to determine what existed on each system before the agent was installed.
If you disable and then re-enable an agent, a new initialization process begins, and the <Initialization files> group changes. Otherwise, the files in this group do not change unless there is a problem with the agent. Upgrading the agent does not change the list of initialized files.
If you click one of the files, it will show a list of File Groups that contain the file, but it will not identify the group containing it for the current computer. This is because a file that predates the agent might have been installed or copied from any one of a variety of places.
If you use a filter with Initialized = Yes on the Files on Computers page with the Show individual box not selected, the table shows rows for <Initialization files> and usually several other files. The other files are known installers, but are also included under the <Initialization files> group.
