Permission rules to add for Volume Shadow Copy

Products

• Carbon Black Cloud Endpoint Standard

Issue/Introduction

Setting up Permission Rules needed for Volume Shadow Copy (VSS) 

Environment

• Carbon Black Cloud Console: Current Versions
• Carbon Black Cloud Sensor Windows Sensor: Supported Versions
• Microsoft Windows : All Supported Versions

Resolution

1. Login to the CB Cloud Console
2. Edit Policy > Prevention Tab
3. Add the following paths to the Permissions section:

   Path:
   **\Volume{some number}\**
   **\GLOBALROOT\Device\VSS Disk name\**
   
   Operation attempt: Performs any operation
   Action: Bypass

Additional Information

• VSS scanning may cause backups to fail . Hence customer may want to exclude VSS from CB scan 
• Path can vary as per environments 
  •  Example with Veritas backup

**\Volume{29e578939-3cac-11e0-ad9b-806e6f6678h63}\**
**\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\**
**\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\**

• Be careful about adding these exclusions internally. The above rules are the only way to exclude the scan. This could however compromise the security as any application/program pertaining to that path can run without being scanned by Endpoint Standard. This is because full bypass rule will ask sensor to fully ignore the path, which means anything happening on that path will be neither monitored nor blocked.