App Control: TMP Files Being Left Behind When Saved to a Fileshare

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Temporary files generated in a network share are not deleted when the application that generated them is closed.

Environment

• App Control Agent: Version 8.1.x - 8.9.2
• Microsoft Windows: All Supported Versions

Cause

Local analysis by the Agent on these renames is preventing remote operations from completing.

Resolution

This issue was tracked under EP-20242 and is resolved in combination of upgrading to Agent 8.9.4+ and creating the following Performance Optimization Rule.

1. Upgrade the Agent on the file server to version 8.9.4 or higher.
2. Log in to the Console and navigate to Rules > Software Rules > Custom.
3. Click Add Custom Rule and use the following details:
   • Rule Name: Ignore TMP Renames On Fileserver (or something memorable)
   • Status: Enabled
   • Platform: Windows
   • Rule Type: Performance Optimization
   • Path or File:

     F:\Specific Path\To\Shared Files\*.tmp

   • Process: Any Process
   • Policies: Selected Policies > Specific Fileserver Policy
4. Click Save & Exit

Additional Information

This Custom Rule could be locked down further with the use of a Hostname Macro in the Path or File, example:

<OnlyIf:Hostname:*FileServer0?>F:\Specific Path\To\Shared Files\*.tmp