App Control: Unable to Start App Control Server Service Due to Error "The volume for a file has been externally altered"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• App Control Server services will not start.
• Error message on service shows "Error 1006: The volume for a file has been externally altered so that the opened file is no longer valid."

Environment

• App Control Server: All Supported Versions
• Microsoft Windows Server: All Supported Versions

Cause

The cause for this issue is that a configuration file gets corrupted during its creation. Thus, when the service starts it is unable to be read this config file at time of execution, so it fails to start.
Most common reasons for the corruption of the config file is the disk running out of space or a security product locking the file.

Resolution

1. Log in to the application server as the Carbon Black Service Account.
2. If an Agent is installed, issue the following commands in an administrative command prompt:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password <Agent Password>
   dascli tamperprotect 0
   net stop parity
   ​​​​​fltmc unload paritydriver

3. Stop the App Control Server and Reporter services, if not already stopped.
4. In File Explorer navigate to: C:\Program Files (x86)\Bit9\Parity Server\ 
5. If the file parityserver.exe.config exists, and is empty, delete it or move it out of the folder.
6. In File Explorer navigate to: C:\Users\<AppCserviceAccount>\AppData\Local\Temp\
7. Delete any files and folders that exist.
   Note: This is safe to do as the folder only contains temp files and any file currently in use will error out when attempting to delete it
8. Attempt to start the App Control Server service, then start the Reporter service.
9. If the services start, and the Agent was temporarily disabled, issue the following commands to restart the Agent:

   ​fltmc load paritydriver
   net start parity

Additional Information

• If the "Carbon Black App Control Reporter" service won't start, the same steps can be taken for "C:\Program Files (x86)\Bit9\Parity Server\Reporter\parityreporter.exe.config"