Tamper Protection Blocks For Notifier Registry Path

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Unable to install or upgrade 3rd party software.
• Agent generating Tamper Protection Events similar to:

  Modification (Create Key) of registry '\\?\globalroot\registry\machine\software\microsoft\windows nt\currentversion\image file execution options\<NOTIFIER>\' by '<user>' was blocked because of Tamper Protection.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

Agent's Tamper Protection is protecting this location in the Registry.

Resolution

If this Tamper Protection block for registry modification is faced while trying to install or update a known-good, trusted piece of software in the environment open a case with support.