Endpoint Standard : Unable to Delete Files From Shared Location or From DFS Share When Carbon Black Sensor is Installed.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Unable to delete files from DFS Share/Shared locations and getting the error "Could not find this item" when sensor is active.
• When the issue occurs, the error(Could not find this item) appears but on refreshing the desktop the file seems to disappear from that location.

Environment

• Endpoint Standard Sensor Version: 3.6.0.1979 & Higher 
• Microsoft Windows: All Supported Versions

Cause

The cause of the issue is currently under investigation.

Resolution

Carbon Black is working on a permanent fix for this issue in the upcoming sensor release 3.8. Currently there is a workaround available as mentioned below. ​​​​

• The registry key 'DirectoryCacheLifetime' has a default value of 10 seconds (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters). Setting this to 0 fixes the issue.  
• For details please refer to the Microsoft Article

 

Additional Information

As a best practice please backup registry before making any changes