Cb Defense: Sensor Upgrade Doesn't Complete Until Reboot
book
Article ID: 288926
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
The Cb Defense Sensor is no longer listed under Programs and Features
Attempting to re-install the sensor manually fails. If the msi.log was created with verbose logging, you will observe "Error 0x80004005: Failed to Install drivers/service "
The confer-temp.log (located in C:\Users\<user>\AppData\Local\Temp\ or C:\Windows\TEMP\)will also contain "Sensor Service already exists. Install aborting."
Both sensor drivers, ctifile.sys and ctinet.sys, still exist under C:\Windows\System32\drivers\
The Cb Defense Sensor service in Services.msc shows "Cb Defense < Failed to Read Description Error Code 2>"
Environment
Cb Defense PSC Console: All Versions
Cb Defense Sensor: 2.0.4 and Higher
Microsoft Windows: All Supported Versions
Sensor upgrade attempt on Windows clients
Sensor is no longer checking in to the PSC Console
Cause
Beginning with Sensor version 2.0.4, a fix was added to suppress sensor reboot. In some cases where Sensor reboot is suppressed, the sensor will be unable to complete clean up of the previous Sensor version and subsequent upgrade to the latest version.
Resolution
Please schedule a time to reboot devices in this state
Once these devices are rebooted, the sensor will finish removing the previous version and within a few minutes, the new Sensor version will be installed successfully
Additional Information
For more details concerning the addition of reboot suppression to the install process, see Cb Defense Known Issue: Some Devices Reboot Without Warning Upon Sensor Update - https://community.carbonblack.com/docs/DOC-6276