Removal of Reputation Approval for a File

If the file reputation approval rule changes in a way that removes reputation approval from a file – by disabling reputation approval completely or by policy, by raising the approval threshold, or by lowering the file’s own reputation – the global approval for that file is eliminated from connected computers, and the file state in the File Catalog reverts to unapproved.

If an instance of this file was executed during the time it was approved by reputation, that instance remains locally approved on the computer where it was executed. Local approval must be removed manually unless you ban the file.

Any explicit assignment of a ban or approval state to a file or its publisher takes precedence over a reputation approval.

Note: Approval by file reputation involves a significant initial impact on the Carbon Black App Control Server because files are analyzed to see whether they would be approved according to Trust Level. Disabling file approvals or changing the approval threshold has a similarly significant impact. Avoid unnecessary changes in file reputation rule configuration.