Endpoint Standard: Endpoints freeze after blocking svchost.exe

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Endpoints freeze after logging into machines

Environment

• Carbon Black Cloud Console: All versions
• Endpoint Standard Sensor: 3.6 and above

Cause

svchost handles many vital functions in Microsoft, by blocking the service, adverse effects occur

Resolution

1. Remove the block for svchost.exe in the policy settings
2. Bypass the endpoint: Enable/Disable Sensor Bypass on Sensors using Command Line (Windows) or from the Sensor UI
3. Reboot the endpoint
4. Verify that the endpoint has updated since svchost was unblocked by checking the last update time of C:\Program Files\Confer\datafile1. If it is after svchost was unblocked, it should be updated
5. Once updated, remove the sensor bypass