App Control: Unable to Enumerate a .msu File
Article ID: 287204
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
- .msu files are not found in console searches.
- .msu files can be crawled if in a trusted directory.
Environment
- App Control Server: All Supported Versions
- App Control Agent: All Supported Versions
Cause
.msu files are not considered as interesting files by App Control.
Resolution
App Control is working as designed.
Additional Information
The .MSU file type contains the below items:
1. Windows Update metadata
2. One or more .cab files
3. An .xml file
4. A properties file
So in essence, the .MSU files do not contain what could be considered executable content. Given this, App Control would not find the files as interesting and thus would not catalog them.
The trusted directory used to house the .msu file uses crawl.exe; this is separate from parity.exe. Parity.exe will not track these files, even though they can be deep-crawled by crawl.exe.
1. Windows Update metadata
2. One or more .cab files
3. An .xml file
4. A properties file
So in essence, the .MSU files do not contain what could be considered executable content. Given this, App Control would not find the files as interesting and thus would not catalog them.
The trusted directory used to house the .msu file uses crawl.exe; this is separate from parity.exe. Parity.exe will not track these files, even though they can be deep-crawled by crawl.exe.
Feedback
Yes
No
Powered by
