Enable Driver Verifier for BSOD Cases

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Steps needed to enable Driver Verifier during BSOD issues on Windows endpoints

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

To enable Driver Verifier, follow these steps:

1. Open a Command Prompt window (Run as administrator)
2. Run the following command

verifier /standard /driver ctifile.sys ctinet.sys

3. Install the Carbon Black Cloud sensor
4. Reboot / reproduce the BSOD and collect a full memory dump

Additional Information

• Once the dump is collected, they should disable Driver Verifier as it can cause additional system instability and performance issues. This can be done by running verifier /reset in an Admin Command Prompt
  • Source: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier#how-to-start-driver-verifier