App Control: Unable to Start App Control Server Service Due to Error "The volume for a file has been externally altered"
searchcancel
App Control: Unable to Start App Control Server Service Due to Error "The volume for a file has been externally altered"
book
Article ID: 286627
calendar_today
Updated On: 04-07-2024
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
App Control Server services will not start.
Error message on service shows "Error 1006: The volume for a file has been externally altered so that the opened file is no longer valid."
Environment
App Control Server: All Supported Versions
Microsoft Windows Server: All Supported Versions
Cause
The cause for this issue is that a configuration file gets corrupted during its creation. Thus, when the service starts it is unable to be read this config file at time of execution, so it fails to start. Most common reasons for the corruption of the config file is the disk running out of space or a security product locking the file.
Resolution
Log in to the application server as the Carbon Black Service Account.
If an Agent is installed, issue the following commands in an administrative command prompt:
cd "C:\Program Files (x86)\Bit9\Parity Agent"
dascli password <Agent Password>
dascli tamperprotect 0
net stop parity
fltmc unload paritydriver
Stop the App Control Server and Reporter services, if not already stopped.
In File Explorer navigate to: C:\Program Files (x86)\Bit9\Parity Server\
If the file parityserver.exe.config exists, and is empty, delete it or move it out of the folder.
In File Explorer navigate to: C:\Users\<AppCserviceAccount>\AppData\Local\Temp\
Delete any files and folders that exist. Note: This is safe to do as the folder only contains temp files and any file currently in use will error out when attempting to delete it
Attempt to start the App Control Server service, then start the Reporter service.
If the services start, and the Agent was temporarily disabled, issue the following commands to restart the Agent:
fltmc load paritydriver
net start parity
Additional Information
If the "Carbon Black App Control Reporter" service won't start, the same steps can be taken for "C:\Program Files (x86)\Bit9\Parity Server\Reporter\parityreporter.exe.config"