App Control: Running "Dascli Validatecerts" on Server 2003/XP Causes Memory Usage Spike

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Running the "Dascli validatecerts" command line to locally revalidate certificates on a Server 2003/XP system results in growing memory usage by the Parity.exe process until it crashes
• Same behavior is seen when the "Allow approval of software with expired certificates" is disabled on the System Configuration > Advanced Options page

Environment

• App Control Windows Agent: All Versions
• Microsoft Windows Server 2003
• Microsoft Windows XP

Cause

This is caused by memory leak in the Operating System's update root certificates module

Resolution

1. Avoid running the "Dascli validatecerts" command locally on Server 2003/XP systems
2. Avoid unchecking the "Allow approval of software with expired certificates" checkbox on the System Configuration > Advanced Options page
3. Alternatively, disable the Operating System's automatic update root certificates module:
   • Control Panel > Add or Remove Programs > Remove Windows Components > Uncheck the box for "Update Root Certificates" > Apply the change
   • (this change requires manual managements of root certificates on the Server 2003/XP system)