App Control: How To Enable Repeated BSOD Prevention
search cancel

App Control: How To Enable Repeated BSOD Prevention


Article ID: 286560


Updated On:


Carbon Black App Control (formerly Cb Protection)


Prevent repeated blue screens due to Policy Enforcement by Agents on endpoints. 


  • App Control Agent: 8.9.2+
  • Microsoft Windows: All Supported Versions


Warning: While in the Override (Visibility) the Agent will not enforce any Custom Rules or Bans until moved back into a Control Mode.
  1. Log in to the Console and navigate to: https://ServerAddress/agent_config.php
  2. Click Add Agent Config and use the following details:
    • Name: Repeated BSOD Prevention (or something memorable)
    • Host ID: 0
    • Value: Change X for the number of BSOD occurrences desired before triggering a move to Visibility on the next reboot.
    • Platform: Windows
    • Status: Enabled
    • Create For: Relevant Policies
  3. Click Save.

Additional Information

  • This feature is disabled by default.
  • This prevention can aid in the event a critical operating system process is being blocked due to an improper Custom Rule or File Ban.
  • When the specified number of blue screens are detected, the Agent will move to a Visibility Policy, preventing further occurrences.
  • Once the Agent starts successfully, a timer will move the Agent out of the Override after reaching the time specified in unsettled_enforcement_override_time_minutes
  • By default, unsettled_enforcement_override_time_minutes is set to 10.
  • A future Health Check will be introduced to alert on this override (EP-19497)