CB Defense: Remote WMI Management Process is Prevented From Working
search cancel

CB Defense: Remote WMI Management Process is Prevented From Working

book

Article ID: 290131

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

  • Remote WMI Process is prevented from completing task
  • Console shows lots of Network related blocks from Powershell by the CB Defense Sensor

Environment

  • CB Defense Sensor: 3.3.0.984
  • Microsoft Windows: All Supported Versions

Cause

  • Policy Rule in place for Denying Operations when applications at path *\powershell*.exe, Communicates over the Network 
  • As part of the Remote WMI process, it calls for Powershell to communicate over the network, and is prevented from doing so by the Policy rule noted above

Resolution

  • Remove the operation attempt 'Communicates over the Network', from the Policy rule where applications at path *\powershell*.exe, Deny Operation