Windows sensor fails to upgrade due to error "FilterUnload for ctifile timed out"

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Carbon Black Cloud Endpoint Standard upgrade fails
• MSI logs have the below entries:

  CAStopDriver:  10/25/24 05:15:56.233: e90      INFO      DriverInstallHelper::StopDriver: Active driver service : ctifile
  CAStopDriver:  10/25/24 05:15:56.233: e90      INFO      Installer: ServiceUtil: Successfully opened a handle to Service
  CAStopDriver:  10/25/24 05:20:56.226: e90      WARNING   DriverInstallHelper::StopDriver: FilterUnload for ctifile timed out after 300000 ms
  CAStopDriver:  10/25/24 05:20:56.230: e90      ERROR     DriverInstallHelper::StopDriver: Stop driver timed out for filefilter, Reboot is required to proceed further
  CAStopDriver:  10/25/24 05:20:56.230: e90      ERROR     Assertion Detected: File Function Assert
  CAStopDriver:  10/25/24 05:20:56.231: e90      INFO      Installer: ServiceUtil: Closing service handle
  CAStopDriver:  CustomActionManager::SetLastErrorMessage: Failed to stop filefilter with error 1603
  CAStopDriver:  10/25/24 05:20:56.233: e90      ERROR     Custom Action CAStopDriver failed. Failed to stop filefilter with error 1603 Return code : 1603
  CAStopDriver:  10/25/24 05:20:56.234: e90      INFO      Ending custom action : CAStopDriver. Return value : 1603. 
  
  CustomAction CustomActionId.StopDriver.ctifile returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
  MSI (s) (F4:24) [05:20:56:367]: Note: 1: 2265 2:  3: -2147287035 
  MSI (s) (F4:24) [05:20:56:367]: User policy value 'DisableRollback' is 0
  MSI (s) (F4:24) [05:20:56:367]: Machine policy value 'DisableRollback' is 0
  Action ended 5:20:56: InstallFinalize. Return value 3.

Environment

Carbon Black Cloud Sensor: All Supported Versions

Cause

Installation fails to unload ctifile even after waiting for 5 minutes.

Resolution

The upgrade should succeed when done immediately after a reboot.

Additional Information

This issue is fixed in 4.0.2+ sensors

• "DSEN-28747: Fixed ctifile.sys driver unload problem
  Fixed an issue that could have prevented the ctifile.sys driver from unloading, which in turn can cause upgrades to fail or require reboots."