Carbon Black Cloud: Unable to open explorer.exe, regedit, or iexplore.exe
search cancel

Carbon Black Cloud: Unable to open explorer.exe, regedit, or iexplore.exe

book

Article ID: 289618

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • If sensor is enabled (not in bypass) after device boot, explorer.exe, regedit, or iexplore.exe will not open 
  • If sensor is enabled before device reboot, explorer.exe will not open. Sensor must be put into bypass from the console to get the Windows task bar back

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Windows Sensor: 3.4.0.1040 and above
  • Microsoft Windows: Microsoft Windows 10 

Cause

This issue can occur if if McAfee IPS is enabled

Resolution

  • Enabling McAfee IPS Adaptive Mode 
OR
  • To Disable McAfee IPS
  1. Open the "McAfee Host Intrusion Prevention Console" on the Device: Path: C:\Windows\Program files\McAfee\Host Intrusion Prevention\McAfeeFire.exe
  2. Step 2. Go to the IPS Policy tab > Uncheck "Enable Host IPS
Note: From the McAfee Server Console you can "Enable Adaptive Mode" without enabling "Enable Host IPS"