Endpoint Standard: wmiprvse.exe Blocked by Cb Defense for trying to modify registry key 077B0BFA804941D4B86DDDC31668BA3C

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• A relevant event will show The application C:\windows\system32\wbem\wmiprvse.exe attempted to modify the Windows Registry Key\Value Name = "\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\98113471A04147740B565CE52B278F1E\077B0BFA804941D4B86DDDC31668BA3C". The operation was blocked by Cb Defense.
• Confer log will see several events related to Windows SCCM and install events related to an earlier version of the sensor than that which is installed
• Similar to lines such as: \device\harddiskvolume4\windows\ccmcache\r\installer_vista_win7_win8-64-3.2.1.51.msi  

Environment

• Endpoint Standard Sensor 3.x
• Windows endpoints (all supported versions). 

Cause

There is an SCCM job running attempting to downgrade the sensor and this is hitting the sensor 'downgrade protection' protecting the keys from being written by SCCM, when it attempts to downgrade to an older version of the sensor than that which currently installed. 

Resolution

There are currently no downgrade/rollback possibilities in 3.6.x and below and the only option is to uninstall/reinstall.