App Control: Agent Service Stuck In Starting When Tanium Is Present
book
Article ID: 286588
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
App Control Agent disconnected in the Console
Viewing services shows the Agent's service stuck in "Starting" state
Performance issues on the endpoint
Environment
App Control Agent: All Supported Versions
Tanium Driver (Threat Response, Integrity Monitor, or Enforce Modules)
Microsoft Windows: All Supported Versions
Cause
A new feature in Tanium's Driver (TaniumRecorderDrv) is interacting with the Agent's Tamper Protection in an unexpected manner.
Once the system is rebooted, and the updated driver is loaded, the issues begin.
Resolution
Tanium and Carbon Black have worked together to resolve this issue. Customers running App Control and Tanium together should:
Upgrade Tanium to version 4.0.1116+ or 4.2.29+
Upgrade App Control to Agent version 8.9.2+
Additional Information
Upgrading either application to the versions above will resolve this issue.
Customers that are unable to upgrade are encouraged to reach out to their Tanium TAM and reference DRIVER-252, and contact Carbon Black Support for additional steps.