Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to use ConfigProps to tune DFS path normalization performance delays

Environment

• CB Defense Sensor: 3.5.0.1646+ and Higher
• Microsoft Windows: All Supported Versions

Resolution

If you are experiencing delays when accessing files across a DFS network, enable the new heuristic changes (these two entries not needed for 3.6+ as they enabled by default) by adding / modifying the following in the cfg.ini using this KB:

SkipNetworkConversionToPhysical=0
OnlyAttemptDFSForPhysicalDeviceNames=1

Alternatively if a DFS file share stops functioning you can force DFS normalization by adding:

NormalizeAlwaysDFSPatterns=<path to server>

example: NormalizeAlwaysDFSPatterns=**servername**

Of if a non-DFS file share that is experiencing delays specify an ignore path to the server by adding:

NormalizeNeverDFSPatterns:<path to server> 

example: NormalizeNeverDFSPatterns=**servername**

Additional Information

Note: Using SkipNetworkConversionToPhysical=1 or OnlyAttemptDFSForPhysicalDeviceNames=1 in 3.5.0.1627 may cause a crash which will be addressed in the next release

• New ConfigProp functionality has been added in 3.5.0.1627+ to help reduce DFS path normalization performance impact on network files path greater than four directories deep.
• These changes can be added via cfg.ini in 3.5.0.1627+ or by using the Rules Management System when released.