CB Response: Windows Endpoint Offline After Upgrade to 6.2.4 Sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Endpoint was upgraded to 6.2.4 sensor version 
• Repeated sensor service startup attempts and crash dumps generated on startup
• Sensor.log shows the following message, but no subsequent logging

Tid[4100] 2019-10-28 16:34:20 (w): Could not find certificate in the store matching this hash

 

Environment

• CB Response Sensor: 6.2.4
• Microsoft Windows: All Supported Versions

Cause

This defect has been identified as CB-29055 which can cause a sensor disconnect on upgrade to 6.2.4 from a previous release

Resolution

1. Uninstall the sensor from the endpoint, and reinstall
2. Upgrade to 6.2.5 sensor release when available

Additional Information

There have been isolated incidences of this same behavior occurring with 6.2.3 sensors; the resolution is to also upgrade to the 6.2.5 sensor.