Windows Store App Blocks With Rapid Config Enabled

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent enforcing blocks on software applications installed/updated via the Windows App Store.
• Rapid Config for Windows App Store is enabled.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The Rapid Config is designed to issue Local Approvals for files when the Agent sees them being written. Changes to the Rapid Config are not retroactive.

• If the files are already written, the Rapid Config will not apply.
• If the files are in a path that is not currently included, the Rapid Config will not apply.

Resolution

Resolve Immediate Issue:

The existing files will need to either be retroactively issued Local Approvals or a temporary Execution Control (Allow) Rule will be needed.

Prevent Future Issues:

Update the Windows App Store Rapid Config accordingly to include the new/adjusted paths for the desired software.

1. Log in to the Console and navigate to Rules > Software Rules > Rapid Configs
2. Edit (pencil icon) the Windows App Store.
3. Add any additional paths that are required.

   Examples:
   <programfiles>\windowsapps\*hpprintercontrol*\*
   <programfiles>\windowsapps\appup.intelgraphicsexperience*\*
   <programfiles>\windowsapps\microsoft.yourphone_*

4. Save the changes.

Additional Information

• Enabling the Rapid Config for Windows App Store does not (by default) allow all software from the App Store.
• Managing the Windows App Store Rapid Config
• Using Wildcards in App Control