App Control: Blocks In the \Windows\WinSxS\Temp\PendingDeletes and \Program Files\Windowsapps\Deleted\ Directory
book
Article ID: 287547
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Blocks in \Windows\WinSxS\Temp\PendingDeletes folder that are unhashed
Blocks in \Program Files\Windowsapps\Deleted\ folder that are unhashed
Environment
App Control Server: All Supported Versions
App Control Agent: All Supported Versions
Cause
Due to how Windows uses this directory during Windows Update / other OS related processes , the files are already deleted by the time our agent starts analyzing it, causing us to respond with an "open file failure" and show a block.
Resolution
There are a few different ways these blocks can be dealt with:
Enforce a scheduled reboot policy in the environment. Under ordinary circumstances, rebooting the device after Windows Updates will clear/prevent these blocks.
This is the safest method as there is no rule that can be taken advantage of.
If the notifier is bothersome to end users, disabling the notifier can alleviate this burden.
This may cause some confusion to end users and/or technicians that are troubleshooting system/application issues.
Create an execution control rule to allow the executions
Generally not recommended as the path processes are usually generic and could be taken advantage of.
A configuration in the console can be added to allow the "open file failure" by using the below steps.