CB Protection: "Error:Log File Was Not Created. Application Was Stopped" When Executing TimedOverride.exe

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

The following error is thrown when running TimedOverride.exe – “Error:Log File Was Not Created. Application Was Stopped" When Executing TimedOverride.exe”

Environment

• CB Protection Agent: 8.1.6
• Microsoft Windows: All Supported Versions

Cause

A log is generated when TimedOverride.exe is launched. This issue occurs when a user that lacks permissions to edit the log file launches the application.

Resolution

This is currently being investigated by VMware Carbon Black. As a temporary workaround:

1. A user with admin priveledges can be used to launch the TimedOverride utility.
2. The log can manually be deleted: 
   • Navigate to C:\Program Files (x86)\Bit9\Parity Agent from a command prompt.
   • Run the following commands:
     • dascli password <globalpassword>
     • dascli tamperprotect 0
   • Navigate to C:\ProgramData\Bit9\Parity Agent\Logs
   • Make a copy of the TimedOverride.bt9 file and store it somewhere safe.
   • Delete the file.