Carbon Black Cloud: Unable to open explorer.exe, regedit, or iexplore.exe

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• If sensor is enabled (not in bypass) after device boot, explorer.exe, regedit, or iexplore.exe will not open 
• If sensor is enabled before device reboot, explorer.exe will not open. Sensor must be put into bypass from the console to get the Windows task bar back

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows Sensor: 3.4.0.1040 and above
• Microsoft Windows: Microsoft Windows 10 

Cause

This issue can occur if if McAfee IPS is enabled

Resolution

• Enabling McAfee IPS Adaptive Mode 

OR

• To Disable McAfee IPS

1. Open the "McAfee Host Intrusion Prevention Console" on the Device: Path: C:\Windows\Program files\McAfee\Host Intrusion Prevention\McAfeeFire.exe
2. Step 2. Go to the IPS Policy tab > Uncheck "Enable Host IPS

Note: From the McAfee Server Console you can "Enable Adaptive Mode" without enabling "Enable Host IPS"