CB Protection: Degraded Endpoint Performance When Running Alongside Trend Micro

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• When running both the CB Protection agent, and Trend Micro AV on an endpoint, it is noted that the system generally performs slower for most tasks.

Environment

• CB Protection Agent:  All Supported Versions
• Windows Operating System: All Supported Versions

Cause

• Exclusions should be put in place to keep the products from scanning each other

Resolution

The following exclusion entries are recommended to keep the agent from scanning the TM agent:
 

kernelProcessExclusions=*\program files\trend micro\officescan client*:2097151,*\program files (x86)\trend micro\officescan client*:2097151 
kernelFileOpExclusions=*\Program Files (x86)\Trend Micro\OfficeScan Client\Temp*:2097151

To add these exclusions:

1. Open the console to https://servername/agent_config.php.   
2. Add a new entry for each of the above items (there should be two entries).
3. Afterwards, allow some time for the new configuration to push out to the endpoints before testing again.

Additionally, Trend Micro should have exclusions put in place for CB Protection.   That is outlined in the following article:
https://community.carbonblack.com/t5/Knowledge-Base/Cb-Protection-Anti-Virus-Exclusions-for-Agent-Windows/ta-p/38334