CB Response: Sensors Unable to Register with DNS Resolution Error

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors fail to register or appear offline in the console
• Sensor diagnostics Server.log shows: 

  Tid[1B8C] 2019-03-03 19:41:29 (w): Failed to registerHTTPCode[0] HrError[0x80C80006] 
  Tid[1B8C] 2019-03-03 19:41:29 (i): failed to register HrError[0x80C80006] 
  Tid[1B8C] 2019-03-03 19:41:29 (w): Unable to properly synch with server HrError[0x80C80006] 
  Tid[1910] 2019-03-03 19:41:35 (e): CreateFile failed Device[\\.\cbndisim] IOCTL[62430004] WinError[0x00000002] 
  Tid[20E0] 2019-03-03 19:41:35 (e): Unable to parse DNS response HrError[0x80070057]

  
   

Environment

• CB Response Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

• Potential networking/DNS resolution issue between the sensor and the Master server

Resolution

• Validate that the DNS URL used for the 'HKLM\Software\Carbon Black\config\SensorBackendServer' registry value is able to be successfully resolved on the endpoint.
• Validate networking allows communication to the DNS URL for the Master server to allow the system to register.

Additional Information

• Error code 0x80C80006 means: 0x80C80006: Facility[CURL] Code[0006] Severity[1] Couldn't resolve host name. 
• Error code 0x80070057 means: 0x80070057: Facility[WIN32] Code[0057] Severity[1] The parameter is incorrect.