Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance
search cancel

Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance


Article ID: 288587


Updated On:


Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)


How to use ConfigProps to tune DFS path normalization performance delays


  • CB Defense Sensor: and Higher
  • Microsoft Windows: All Supported Versions


If you are experiencing delays when accessing files across a DFS network, enable the new heuristic changes (these two entries not needed for 3.6+ as they enabled by default) by adding / modifying the following in the cfg.ini using this KB:
Alternatively if a DFS file share stops functioning you can force DFS normalization by adding:
NormalizeAlwaysDFSPatterns=<path to server>

example: NormalizeAlwaysDFSPatterns=**servername**
Of if a non-DFS file share that is experiencing delays specify an ignore path to the server by adding:
NormalizeNeverDFSPatterns:<path to server> 

example: NormalizeNeverDFSPatterns=**servername**

Additional Information

Note: Using SkipNetworkConversionToPhysical=1 or OnlyAttemptDFSForPhysicalDeviceNames=1 in may cause a crash which will be addressed in the next release

  • New ConfigProp functionality has been added in to help reduce DFS path normalization performance impact on network files path greater than four directories deep.
  • These changes can be added via cfg.ini in or by using the Rules Management System when released.