EDR: Cbstream Driver Fails to Start

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

cbstream driver fails to start with “There are no more endpoints available from the endpoint mapper."

Environment

• EDR Sensor 6.x and Higher
• Microsoft Windows: All Supported Versions

Cause

The cbstream driver relies on the Windows Base Filtering Engine (BFE) service to be running

Resolution

1. In an elevated command prompt run the command "sc start BFE"
2. If the BFE service fails to start troubleshoot why this Windows service is not starting