Carbon Black Cloud: Unable to open explorer.exe, regedit, or iexplore.exe
book
Article ID: 289618
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
If sensor is enabled (not in bypass) after device boot, explorer.exe, regedit, or iexplore.exe will not open
If sensor is enabled before device reboot, explorer.exe will not open. Sensor must be put into bypass from the console to get the Windows task bar back
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Windows Sensor: 3.4.0.1040 and above
Microsoft Windows: Microsoft Windows 10
Cause
This issue can occur if if McAfee IPS is enabled
Resolution
Enabling McAfee IPS Adaptive Mode
OR
To Disable McAfee IPS
Open the "McAfee Host Intrusion Prevention Console" on the Device: Path: C:\Windows\Program files\McAfee\Host Intrusion Prevention\McAfeeFire.exe
Step 2. Go to the IPS Policy tab > Uncheck "Enable Host IPS
Note: From the McAfee Server Console you can "Enable Adaptive Mode" without enabling "Enable Host IPS"