What is the Best Practice for Upgrading an Operating System With the Sensor Installed?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What is the best practice recommendation for the Sensor state when upgrading any operating system?

Environment

• Carbon Black Cloud Sensor: All supported versions
• Carbon Black Cloud Console: All supported versions
• Microsoft Windows: All supported versions
• Apple macOS: All supported versions
• Linux: All supported versions

Resolution

There is currently no best practice for applying updates or upgrades to the operating system

Additional Information

• With all supported Sensor versions the Operating System upgrades / updates should be allowed to run normally with the Sensor active
• With some Windows Patching it may be necessary to add an exclusion for c:\$windows.~bt\sources\setuphost.exe as it may perform behavior that the sensor sees as ransomware like behavior
• If you have any issues with installing upgrades / updates with the Sensor active please open a Support Case