App Control: Agent upgrade failed because it was unable to start the ParityDriver

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Upgrade log shows the following failure error message:

1: <Bit9 Log> Starting ParityDriver

1: <Bit9 Log> (FAILURE) Unable to start ParityDriver service

Environment

• App Control Agent: 6.0.2.x and higher

Cause

• The old ParityDriver was not deleted. There are 2 different versions of ParityDriver files on the system.
• A separate security application prevented the Parity Driver from loading.

Resolution

1. On the endpoint, run the following on an elevated command prompt while in the %program files%\Bit9\Parity Agent directory:

dascli password {CLI password here}
dascli tamperprotect 0
net stop parity
fltmc unload paritydriver

2. Go to C:\Windows\System32\Drivers and delete the Parity.sys file.
3. Go to C:\Windows\System32\Drivers and delete the Parity.sys file.
4. Go to C:\Windows\System32\DRVSTORE\ and delete the Parity_... folder.
5. Open the registry and go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DIFX and delete the Parity_... registry key folder if it’s still present.
6. Follow these steps to manually upgrade the Agent but add NOSTARTPARITY and NOSTARTDRIVER on the command.

Example:
msiexec /i {path}\{filename}.msi NOSTARTPARITY=1 NOSTARTDRIVER=1 /l*v {path}\manual_install.log
msiexec /p {path}\{filename}.msp NOSTARTPARITY=1 NOSTARTDRIVER=1 /l*v {path}\manual_install.log

7. In the registry, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\paritydriver.
8. Add the DWORD called "Start" if it’s not present and set it to 0.
9. Reboot the machine.
10. Open a command prompt and change directory to %program files%\Bit9\Parity Agent. Run “dascli status” to verify the version.