App Control: Running "Dascli Validatecerts" on Server 2003/XP Causes Memory Usage Spike
search cancel

App Control: Running "Dascli Validatecerts" on Server 2003/XP Causes Memory Usage Spike

book

Article ID: 288981

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Running the "Dascli validatecerts" command line to locally revalidate certificates on a Server 2003/XP system results in growing memory usage by the Parity.exe process until it crashes
  • Same behavior is seen when the "Allow approval of software with expired certificates" is disabled on the System Configuration > Advanced Options page

Environment

  • App Control Windows Agent: All Versions
  • Microsoft Windows Server 2003
  • Microsoft Windows XP

Cause

This is caused by memory leak in the Operating System's update root certificates module

Resolution

  1. Avoid running the "Dascli validatecerts" command locally on Server 2003/XP systems
  2. Avoid unchecking the "Allow approval of software with expired certificates" checkbox on the System Configuration > Advanced Options page
  3. Alternatively, disable the Operating System's automatic update root certificates module:
    • Control Panel > Add or Remove Programs > Remove Windows Components > Uncheck the box for "Update Root Certificates" > Apply the change
    • (this change requires manual managements of root certificates on the Server 2003/XP system)