CB Response: Sensor Preventing Successful Windows OS Updates

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

CB Response Sensor preventing Windows OS updates from completing successfully.

Environment

• CB Response Server: 6.3.1
• CB Response Sensor: 6.1.9

Cause

• cb.exe renamed to svchost.exe
• A sharing violation occurs when stdeploy.exe tries to access itself with 'Delete' ability while the Carbon Black service is still reading it.

Resolution

• Upgrade to CB Response Sensor 6.2.4, which skips trying to retrieve Certificate Revocation Lists (CRLs) from the Internet.
• Disable "Binary Info" collection, which will prevent the sensor from checking the signing status.