WSC Integration Service Won't Start on Windows Servers

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Carbon Black Cloud WSC service (CbDefenseWSC) fails to start after upgrading or installing the sensor even when "Use Windows Security Center" policy is enabled
• Upon attempting to start the service manually, a message is displayed, similar to: "The Carbon Black Cloud WSC service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs".
• System log in Event Viewer shows the following entries:

Log Name: System
Source: Service Control Manager
Event ID: 7036
The Carbon Black Cloud Sensor WSC service entered the running state.

Log Name: System
Source: Service Control Manager
Event ID: 7036
The Carbon Black Cloud Sensor WSC service entered the stopped state.

Environment

• Endpoint Standard Sensor: All supported versions
• Microsoft Windows: All supported versions

Cause

The Carbon Black Cloud Sensor WSC service has a dependency on Microsoft's Windows Security Center; if it is not present then the WSC will not start.

Resolution

The Windows Security Center is not installed by default in server-class operating systems. To verify the presence of Windows Security Center:

1. Run the following command from the command line interpreter:

sc query wscsvc

2. Should the Security Center service be missing (see example below), the Carbon Black Cloud Sensor WSC service will not start

[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service