Carbon Black Cloud: Unable to save work to a network (SMB/DFS) drive unless "save" button selected twice

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Common Windows tools (notepad.exe, textpad.exe, excel.exe) silently fail to save work to a network file share.
• If the user tries to "save" twice, the second attempt works.
• If the CBC sensor is placed into Bypass mode, the problem disappears.

Environment

• CBC Sensor: All versions
• CBC Console: All versions
• Microsoft Windows: All versions

Cause

1. The Windows computer is also running Trend Micro sensor.
2. This is Trend Micro defect where Trend added the following to the Data Protection Policy (DLP)

File: C:\Windows\System32\dgagent\dsa.pro
Added Line: smb_disable_get_long_path_name=true
Trend Agent: ApexOne (SaaS)
Trend Internal tracking number:  Trend Case:05427594

Resolution

Trend Micro has supplied a fix, so contact their Support directly.