Endpoint encountering BSOD style error after 4.x sensor installation with INACCESSIBLE BOOT DEVICE stop code.
search cancel

Endpoint encountering BSOD style error after 4.x sensor installation with INACCESSIBLE BOOT DEVICE stop code.

book

Article ID: 388882

calendar_today

Updated On:

Products

Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops) Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • BSOD behavior after sensor installation
  • BSOD indicates "INACCESSIBLE BOOT DEVICE" as stop code

Environment

  • Carbon Black Cloud Sensor
  • Microsoft Windows: 4.X sensors

Cause

Product Defect, tracked as: DSEN-28479

Resolution

Expected to be fixed in future release.  To address this on existing sensors:

  1. Launch gpedit.exe on endpoint
  2. Navigate to Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy"
  3. If setting is "Good Only", modify the setting to "Good and Unknown"

Additional Information

This issue is caused by CbELAM.sys driver classification

Powered by Wolken Software