App Control: Agent Service Stuck In Starting When Tanium Is Present

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• App Control Agent disconnected in the Console
• Viewing services shows the Agent's service stuck in "Starting" state 
• Performance issues on the endpoint

Environment

• App Control Agent: All Supported Versions
• Tanium Driver (Threat Response, Integrity Monitor, or Enforce Modules)
• Microsoft Windows: All Supported Versions

Cause

• A new feature in Tanium's Driver (TaniumRecorderDrv) is interacting with the Agent's Tamper Protection in an unexpected manner.
• Once the system is rebooted, and the updated driver is loaded, the issues begin.

Resolution

Tanium and Carbon Black have worked together to resolve this issue. Customers running App Control and Tanium together should:

1. Upgrade Tanium to version 4.0.1116+ or 4.2.29+
2. Upgrade App Control to Agent version 8.9.2+

Additional Information

• Upgrading either application to the versions above will resolve this issue.
• Customers that are unable to upgrade are encouraged to reach out to their Tanium TAM and reference DRIVER-252, and contact Carbon Black Support for additional steps.