Carbon Black Cloud: Service Not Starting At Boot

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Event Viewer shows several services (including Carbon Black Clouds 'CbDefense' service with errors:

Event ID:7000
The CbDefense service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Event ID:7009
A timeout was reached (30000 milliseconds) while waiting for the CbDefense service to connect.

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

This can be caused by the device not having enough system resources to start the service within the default timeout (30,000 milliseconds)

Resolution

1. Confirm the device meets all Windows OS and Carbon Black Cloud OER requirements
   • https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-oer-win-sensor-on-desktop/GUID-E961D584-DD81-46CB-9DC2-2DC6E44DD9E0.html
2. If needed, the timeout can be adjusted:
   1. Click Start > Run > Regedit.exe
   2. Locate the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
   3. Edit 'ServicesPipeTimeout' from 30000 to something higher (such as 60000)
   4. Restart the device

Additional Information

If 'ServicesPipeTimeout' does not exist, it can be created:

1. Right click > New > DWORD Value.
2. Give it the name "ServicesPipeTimeout"
3. Right Click > Modify.
4. Choose Base > Decimal
5. Value Data: 60000 (or desired value)
6. Restart the computer