TMP Files Left Behind on Network Share After Closing MS Office Applications

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• After saving and/or closing an MS Office document residing on a network share, randomly named .tmp files are left behind
• Normally, these are created when editing an MS Office document and automatically deleted after saving and closing
• The tmp files are stored in the same path as the file that was edited

Environment

• Carbon Black Cloud Sensor: 4.0.3 and below
• Microsoft Office Applications

Cause

Issue with 4.0.3 and below sensors

Resolution

1. Upgrade to Sensor version 4.1+
   • this issue has been resolved via CRE-20060
2. If the issue still persists, collect Sensor Logs while replicating the issue