EDR Sensor: Cannot RDP to Server 2008 R2 after upgrading to 7.2

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Upgrading to 7.2 causes the server login to hang
• Issue disappears when server upgraded to Windows Server 2019

Environment

• EDR Sensor: Upgrade from 6.1.7 to 7.2
• Microsoft Windows Server 2008 R2
• Symantec

Cause

Unknown. Potentially due to AV interoperability issues

Resolution

Ensure proper exclusions are present on other AV or scanners: https://community.carbonblack.com/t5/Knowledge-Base/EDR-Which-Sensor-directories-need-exclusion-from-3rd-party-anti/ta-p/62178
 

Additional Information

If issue persists, collect a procmon during login: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-collect-a-Procmon-for-Boot-Login-Sensor-Performance/ta-p/75287