EDR Sensor: Password rotation via CybarArk on Windows Server 2012 fails on 7.2

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Password rotation on Windows Server 2012 intermittently fails with 7.2
• Rotation works in 7.1 and below

Environment

• EDR Sensor: 7.2 and Higher
• Windows Server 2012
• CyberArk

Cause

This is due to a known Windows defect in Server 2012. 

Resolution

• This is a limitation of the Microsoft version which is fixed in Server 2008 R2/2012 R2
• Workarounds:
  • Downgrade to 7.1.1
  • Delay the start of the sensor
    • Open an Administrator Command prompt and execute the following

sc config carbonblackk start= demand
sc config carbonblack start= delayed-auto