CB Response: Sensor Preventing Successful Windows OS Updates
search cancel

CB Response: Sensor Preventing Successful Windows OS Updates

book

Article ID: 287230

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

CB Response Sensor preventing Windows OS updates from completing successfully.

Environment

  • CB Response Server: 6.3.1
  • CB Response Sensor: 6.1.9

Cause

  • cb.exe renamed to svchost.exe
  • A sharing violation occurs when stdeploy.exe tries to access itself with 'Delete' ability while¬†the Carbon Black service is still reading it.

Resolution

  • Upgrade to CB Response Sensor 6.2.4, which skips trying to retrieve Certificate Revocation Lists (CRLs) from the Internet.
  • Disable "Binary Info" collection, which will prevent the sensor from checking the signing status.