CB Response: How to Resolve Handle Count Health Events (Windows)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Resolve handle count and GDI handle count health events.

Environment

• CB Response Console: All Versions
• Microsoft Windows: All Supported Versions

Resolution

• Analyze event collection to see if an event is generating an excessive count.
• If these are Non-Binary file writes, this collection type can be often be turned off: Turning off event-collection of Non-Binary file writes