Carbon Black Cloud: What do the Background Scan Statuses mean?
search cancel

Carbon Black Cloud: What do the Background Scan Statuses mean?


Article ID: 287355


Updated On:


Carbon Black Cloud Endpoint Standard (formerly Cb Defense)


What do the background scan statuses in Event Viewer mean?


  • CB Defense Sensor and Higher
  • Microsoft Windows: All Supported Versions


BACKGROUND_SCAN: DISABLEDThis message is recorded each time when the Carbon Black Cloud sensor service starts (typically after Windows reboot).  This indicates that background is disabled for the device (either at the policy level or at the organization level.)
BACKGROUND_SCAN: IN_PROGRESSThis message is recorded when the background scan starts.  If the Carbon Black Cloud sensor service restarts (typically when Windows reboots) this message is recorded. The Carbon Black Cloud sensor service will resume from the previous scanned location.
BACKGROUND_SCAN: COMPLETEThis message is recorded once the background scan completes.  There will be no more occurrence after background scan completes – as each device will perform the background scan just once.

Additional Information

These events are purely informational and require no further action. You can read further on how the Background Scan works in the Background Scan FAQ article linked under related content.