Endpoint Standard: Issues in accessing PDFs shared and transferred by multi-function copier

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• The documents can be scanned by multi-function copier and the file was changed to PDF
• When trying to access the PDF through a shared folder, the PDF icon is displayed, however PDF cannot be accessed.
• Following error is displayed on the multi-function copier:

Unexpected SMB server error

• No alerts are observed in Carbon Black cloud console .
• The issue is resolved after applying "monitored policy", by placing sensor in bypass mode or by uninstalling the sensor.

Environment

• Endpoint Standard sensor: 3.6.0.1897
• Carbon Black Cloud console: All supported versions
• Microsoft windows: All supported versions

Cause

The cause of this issue is under investigation.

Resolution

1. If a similar issue is experienced collect logs outlined in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Collect-Process-Monitor-Logs-When/ta-p/66177
2. Open a case with Carbon Black Support referencing this article and the logs uploaded