App Control: Unable to Enumerate a .msu File
search cancel

App Control: Unable to Enumerate a .msu File

book

Article ID: 287204

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • .msu files are not found in console searches.
  • .msu files can be crawled if in a trusted directory.

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions

Cause

.msu files are not considered as interesting files by App Control.

Resolution

App Control is working as designed.

Additional Information

The .MSU file type contains the below items:
1. Windows Update metadata
2. One or more .cab files
3. An .xml file
4. A properties file
So in essence, the .MSU files do not contain what could be considered executable content. Given this, App Control would not find the files as interesting and thus would not catalog them.
The trusted directory used to house the .msu file uses crawl.exe; this is separate from parity.exe. Parity.exe will not track these files, even though they can be deep-crawled by crawl.exe.