CB Protection: CB Protection Agent Service Fails to Start

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• CB Protection Agent service fails to automatically start during boot
• Manual attempts to start the service fail

Environment

• CB Protection Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The most common cause for this scenario is a third party antivirus injecting into Parity.exe

Resolution

The easiest way to resolve this issue is to confirm that third-party antivirus has exclusions for CB Protection. The method used to confirm or add exclusions will differ based upon the product and version used. You can confirm injection by:

1. Download Process Monitor from Microsoft's website
2. Run Procmon.exe
3. Attempt to start the CB Protection Agent service multiple times
4. Stop the Procmon.exe capture - File > uncheck Capture Events
5. Locate Parity.exe under process and look for Image Load under Operation
6. Double click the operation
7. Navigate to the Process tab
8. Examine the Modules window for processes that are injecting.