CB Defense: ServiceManager.exe crashes when Symantec Endpoint Protection is present

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Server Manager (ServiceManager.exe) crashes after installing CbD 3.2.1.51
• No alerts or blocking events

Environment

• CB Defense Sensor 3.2.1.51
• Microsoft Windows Server 2012 R2 x64 Server Standard (6.3.9600)
• Symantec Endpoint Protection 14.2.1031.0100

Cause

•  Known Symantec/Carbon Black compatibility issue

Resolution

• Upgrade to CB Defense Version 3.4.0.820 (please note Carbon Black recommends testing prior to rolling out changes into production)
• If unable to upgrade to 3.4.0.820, implement this temporary workaround:

1. From the Symantec Endpoint Protection Manager, create a folder exclusion for:

C:\Program Files\Confer

2. From the PSC (CB Defense) console, create an API bypass for:

C:\Windows\system32\ServerManager.exe