Back to Top


What do I do if my Carbon Black icon has a red "x" on my Mac?

The red "X" icon means that the Carbon Black antivirus program is offline.  This is mainly caused by an update that needs to be "allowed" in order for the newer version to be installed.  Unfortunately, the program will get stuck in the offline mode while it waits for the user to allow the upgrade.   This needs to be resolved as soon as possible in order to assure protection of your device.


Carbon Black Offline (Red "X")





1. Open System Preferences.  Go to Security and Privacy.  Select the General tab.


3. You will need to unlock the System Preferences window to make changes.


Unlock system preferences






4. At the bottom of the General tab, you may see a statement asking you to allow VMware CBCloud.  Click "Allow".  If more that one program is waiting to be approved, you may see a "Details" button.  Click "Details" then allow Carbon Black. 


Allow Carbon Black Extension





5. If the red "X" does not disappear, then restart your computer.  If the red "X" still exist after restart, then within System Preferences, go to Security and Privacy.  Under the Privacy tab, on the left side, select "Full Disk Access".  


Full disk access















6. Leaving the System Prefernces Window open, open finder.  Go to applications.  Scroll down to VMware Carbon Black and open the folder.



Carbon Black in finder













7. Select the following files from the Vmware Carbon Black Cloud folder and drag them to the list on the right in the System Preference window.  It is ok if they do not appear in the list afterwards.  Just drag and drop. Again you may not see these items on the target list after you drop them.  That is normal.

LiveQuery bundle

repmgr bundle

unistall bundle

VMware CBCloud (with blue icon)


8. Restart the Mac.  If there is still a red "x" on the CB icon, please email

REMEMBER:  Restart your Mac at least once a week!