Windows Sensor is Slow to Boot

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Unusually slow bootup time on a Windows endpoint

Environment

• Carbon Black EDR Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The AntiVirus software (such as Windows Defender) scans the Sensor directory, which consumes resources and causes delays in bootup.

Resolution

Validate AV exclusions are in place for all security software installed on the endpoint: Third-party AV Scan Exclusions

If the issue persists, collect performance based logs during a reproduction at boot. How to collect a Procmon for Boot/Login Sensor Performance

1. Open the captured boot log file. 
2. Click the Tools menu > Process Activity Summary.
3. Click the CPU column to sort the entries.
4. Note the highest processes, which are likely to be AntiVirus software related (example: MsMpEng.exe is Windows Defender).
5. If further assistance is needed, open a support case for investigation. 

 

 

Additional Information

If the sensor process name was modified in the sensor groups page, please add the new process name to the exclusions list