Sensor is Overwriting Modifications to the Hosts file on Reboot.

Products

• Carbon Black EDR

Issue/Introduction

When modifying the host file on an endpoint, the lines added or modified are removed on reboot. 

Environment

• Carbon Black EDR Sensor: 7.x and higher
• Microsoft Windows: All Supported Versions

Cause

Editing within the EDR managed block. 

Resolution

Make the changes to the hosts file outside the begin and end of the EDR managed block. 

#BEGIN_CBEDR
#do not edit this block, it is controlled by VMware CB EDR.
x.x.x.x primary
x.x.x.x datastore
#END_CBEDR

Additional Information

Why does the Windows Sensor Modify Hosts file?