Local State Details

Local State is the Carbon Black App Control classification of a particular instance of a file on a particular computer. This information is primarily for use by VMware Carbon Black Support, but it can be useful in determining why a file was assigned its top-level Local State.

Table 1. Local (File) State Details

State	Description
Approved	Approval state on the local computer for files that are globally approved in the File Catalog.
Approved (Not Persisted)	Approval state on the local computer for files approved by certain pre-version-6.0 methods but are not globally approved in the File Catalog. If you delete a file in this state, new instances would not necessarily be locally approved.
Approved as Installer	Approval state for top-level installers (in Windows) that indicates that the installer and the files it contains have been hashed, analyzed, and globally approved by Carbon Black App Control. When users execute these files, the Carbon Black App Control Agent permits them to run as globally approved files. This state is not common and is unnecessary for local approval of files generated by an installer.
Approved as Installer(Top Level)	Approval state for top-level installers. The installer was globally approved and when executed, the files it generates are locally approved. On macOS computers, only files associated with the native macOS updater (that is, .pkg files) are identified as installers.
Banned	Files with specified hash are not allowed to execute on the computers specified (all computers or by policy).
Banned(Report Only)	Test file state for files that are to be banned by hash. Carbon Black App Control permits files that are banned but in Report-Only to execute but records a “would have blocked” message in the event log to show how the file would have been handled if the ban were active.
Locally Approved	File is approved to run on the local computer but unapproved (globally or for the current policy) in the File Catalog. Files can be locally approved so that they can be installed on one computer without approving them for any other computer running the agent.
Locally Approved (Auto)	File is approved to run on the local computer because it was written by a trusted installer or updater. Except for the source of its approval, this is the same as Locally Approved.
Unapproved	File appeared after agent initialization and has not been approved. Depending on Enforcement Level on each computer, the agent either blocks the file or permits its execution. These files might become locally approved if a computer transitions from Low (or no) Enforcement to Medium or High, depending upon policy settings. Files are assigned Unapproved local state details if the first local instance was found when the Enforcement Level was Low (Monitor Unapproved) or None (Visibility Only). See Automatic Local Approval on Enforcement Level Change.
Unapproved (Persisted)	File appeared after agent initialization and has not been approved. Unapproved (Persisted) files do not become locally approved when a computer changes from Low or None (Visibility) Enforcement to High or Medium Enforcement. Files are assigned Unapproved (Persisted) local state details if the first local instance was found when the machine was in High or Medium Enforcement Level.