Cb Defense: Sensor Upgrade Doesn't Complete Until Reboot

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• The Cb Defense Sensor is no longer listed under Programs and Features
• Attempting to re-install the sensor manually fails. If the msi.log was created with verbose logging, you will observe "Error 0x80004005: Failed to Install drivers/service "
• The confer-temp.log (located in C:\Users\<user>\AppData\Local\Temp\ or C:\Windows\TEMP\)will also contain "Sensor Service already exists. Install aborting."
• Both sensor drivers, ctifile.sys and ctinet.sys, still exist under C:\Windows\System32\drivers\
• The Cb Defense Sensor service in Services.msc shows "Cb Defense < Failed to Read Description Error Code 2>"
  

Environment

• Cb Defense PSC Console: All Versions
• Cb Defense Sensor: 2.0.4 and Higher
• Microsoft Windows: All Supported Versions
• Sensor upgrade attempt on Windows clients
• Sensor is no longer checking in to the PSC Console

Cause

Beginning with Sensor version 2.0.4, a fix was added to suppress sensor reboot. In some cases where Sensor reboot is suppressed, the sensor will be unable to complete clean up of the previous Sensor version and subsequent upgrade to the latest version.

Resolution

• Please schedule a time to reboot devices in this state
• Once these devices are rebooted, the sensor will finish removing the previous version and within a few minutes, the new Sensor version will be installed successfully

Additional Information

For more details concerning the addition of reboot suppression to the install process, see Cb Defense Known Issue: Some Devices Reboot Without Warning Upon Sensor Update - https://community.carbonblack.com/docs/DOC-6276