CB Response: Windows Sensor slow to boot

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Unusually slow bootup time on Windows endpoint

Environment

• CB Response Sensor: (All versions)
• Microsoft Windows: All Supported Versions

Cause

The AntiVirus software (such as Windows Defender) scans the CB Response Sensor directory, which consumes resources and causes delays in bootup.

Steps to confirm:

1. Ensure the CB Response Sensor is installed
2. Gather boot logs (requires a reboot)
   • CB Response: How to collect a Procmon for Boot/Login Sensor Performance
3. Open the captured boot log file
4. Click the Tools menu > Process Activity Summary
5. Click the CPU column to sort the entries
6. Note the highest processes, which are likely to be AntiVirus software related (example: MsMpEng.exe is Windows Defender)

Resolution

1. Configure the AntiVirus software to ignore the Cb Response Sensor directory (%WINDIR%\CarbonBlack\* by default)
2. Configure the AntiVirus software to ignore the Cb Response Sensor Process (cb.exe)

Additional Information

If the sensor process name was modified in the sensor groups page, please add the new process name to the exclusions list