Endpoint Standard Windows sensor fails to upgrade

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Carbon Black Cloud Endpoint Standard upgrade to version 3.9.2.2628 fails.

MSI logs have the below entries:

CAStopDriver:  10/25/24 05:15:56.233: e90      INFO      DriverInstallHelper::StopDriver: Active driver service : ctifile
CAStopDriver:  10/25/24 05:15:56.233: e90      INFO      Installer: ServiceUtil: Successfully opened a handle to Service
CAStopDriver:  10/25/24 05:20:56.226: e90      WARNING   DriverInstallHelper::StopDriver: FilterUnload for ctifile timed out after 300000 ms
CAStopDriver:  10/25/24 05:20:56.230: e90      ERROR     DriverInstallHelper::StopDriver: Stop driver timed out for filefilter, Reboot is required to proceed further
CAStopDriver:  10/25/24 05:20:56.230: e90      ERROR     Assertion Detected: File Function Assert
CAStopDriver:  10/25/24 05:20:56.231: e90      INFO      Installer: ServiceUtil: Closing service handle
CAStopDriver:  CustomActionManager::SetLastErrorMessage: Failed to stop filefilter with error 1603
CAStopDriver:  10/25/24 05:20:56.233: e90      ERROR     Custom Action CAStopDriver failed. Failed to stop filefilter with error 1603 Return code : 1603
CAStopDriver:  10/25/24 05:20:56.234: e90      INFO      Ending custom action : CAStopDriver. Return value : 1603. 

CustomAction CustomActionId.StopDriver.ctifile returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (F4:24) [05:20:56:367]: Note: 1: 2265 2:  3: -2147287035 
MSI (s) (F4:24) [05:20:56:367]: User policy value 'DisableRollback' is 0
MSI (s) (F4:24) [05:20:56:367]: Machine policy value 'DisableRollback' is 0
Action ended 5:20:56: InstallFinalize. Return value 3.

Environment

Carbon Black Cloud Sensor: All Supported Versions

Cause

Installation fails to unload ctifile even after waiting for 5 minutes.

Resolution

The upgrade should succeed when done immediately after reboot which will unload ctifile.