Medium Enforcement Has Notifier Timeout, Delayed Notifier, or Unexpected Blocks

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Unexpected Blocks while in Medium enforcement
• Applications not launching when "run as admin" selected
• Delayed Notifier popup
• Events in console with subtype "Execution block (prompt timeout)
• Windows Event Viewer (System) logs show error "Cannot change to default directory "C:\ProgramData\Bit9\Parity"Agent\images"

Environment

• App Control Agent: 8.x
• Microsoft Windows: All Supported Versions

Cause

The agent is trying to display the notifier in a non-interactive session and times out.

Resolution

1. This can be caused if another AV is scanning the Agent, make sure that the AV Exclusions are in place.
2. Disable the Anti-Virus applications temporarily to verify if they are causing an interop with the notifier's ability to launch.
3. If the issue persists and while the AV's are disabled, collect Collect Agent Performance Logs during a reproduction and open a support case for further review. 

Additional Information

• Check vendor documentation for adding exclusions and the format expected. Some vendors may have multiple areas for exclusions based on separate features in the product.