CB Protection: Protection Server Unexpected Tamper Events

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Tamper Protection events generated on the Protection Server host.
• The events always occur at the startup time of the Protection Agent.

For example:

2019-11-18 09:18:02 Agent shutdown due to a system shundown
2019-11-18 09:19:12 "Exclusive access to c:\program files (x86)\bit9\parity server\shepherd.dsn by user\computer was blocked because of tamper protection."
2019-11-18 09:19:13 Agent restart

Environment

• CB Protection Server: 8.1.0+
• CB Protection Agent: 8.1.0+

Cause

Bug EP-8383.

Resolution

This bug is planned to be fixed on 8.6.0.