Although you can request deletion of files from file table pages, you might want more information about the file before you decide to delete it. For this, you can go to the File Details or File Instance Details page.
The Actions menu on these pages allows you to delete the file from the current computer or all computers.
Request File Deletion Using the File Instance Details Page
Use this procedure to request deletion of a file via the File Instance Details page.
- When you locate a file you want to delete the Files on Computers or Find Files page, click the View Details button next to its listing in a table. The File Instance Details page appears.
- Examine the information on the File Instance Details page to be certain you want to delete all instances of the file from the computer shown.
- If you have Carbon Black File Reputation enabled, the Carbon Black File Reputation Information panel shows Trust, Threat, and other information about the file, if available. You can click the View Carbon Black Reputation Data button to search Carbon Black File Reputation for information if none is shown or to check for updated information.
- In the Actions menu, choose to delete files from the current computer or all computers:
- Delete All Files Instances from <computername> – This submits a request to delete all instances of the file on the named computer. Any other instances of the file remain in place.
- Delete File from All Computers – This submits a request to delete all instances of the file on all computers reporting to the current server
- Examine the information in the confirmation box, and if you want to proceed with the deletion, click OK.
A banner indicating that the delete request was successfully created should appear. All instances of the file are scheduled for deletion on one or all computers. Check the Events page to confirm that the files are actually deleted or see any error messages related to the action, such as failure to delete a file that cannot be deleted or failure to delete a file that may have been deleted locally before it could be deleted by App Control.