Error: "Bypass (Extension error)" after Windows sensor upgrade
search cancel

Error: "Bypass (Extension error)" after Windows sensor upgrade

book

Article ID: 284883

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

After upgrade sensor(s) status is Bypass indicating Bypass (Extension error)

Environment

  • Carbon Black Cloud Sensor: 3.7 - 4.0.0.1292 
  • Microsoft Windows (All supported versions)

Cause

  • DSEN-22274: Due to a race condition, sensors upgraded from the CBC console can occasionally result in the sensor being stuck in bypass after upgrade, requiring a reboot to restore.
  • Race condition is due to an interop with the OS. Carbon Black is investigating (DSEN-25236).

Resolution

  • Reboot system for sensors 3.9.2.2698 and below
  • DSEN-25236 has been determined to be a Microsoft bug. Upcoming sensor release 4.0 MR1 slated for end of April contains a workaround. (See additional notes)

Additional Information

  • (DSEN-16957,DSEN-21771, DSEN-23573) have been resolved in previously released sensor versions.
  • DSEN-25236 is still open and determined to be a Microsoft bug. Carbon Black engineers have a case open with Microsoft and are working towards a permanent resolution with no estimated timeline.