Windows sensor fails to upgrade with "Custom Action CAStopDriver failed." error.

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Workload
• Carbon Black Cloud Audit and Remediation

Issue/Introduction

A Windows CBC sensor can fail to upgrade if the previous sensor driver cannot be successfully stopped and removed as part of the upgrade process. The cb-installer-<version>.log file will report an error message like:

<DATE> <TIME>: 116c     ERROR     Assertion Detected: File[<Path>\install.cpp@1598] Function[DriverInstallHelper::StopDriver] Assert[false]
<DATE> <TIME>: 116c     INFO      Installer: ServiceUtil[3]: Closing service handle
<DATE> <TIME>: 116c     ERROR     Custom Action CAStopDriver failed. Failed to stop filefilter with error 1603 Return code : 1603
<DATE> <TIME>: 116c     INFO      Ending custom action : CAStopDriver. Return value : 1603

Environment

• Carbon Black Cloud Console: Current Version
• Carbon Black Cloud Sensor: All Versions
• Microsoft Windows OS: Supported Versions

Cause

The installation process is designed to rollback if the previous sensor is unable to be successfully removed before attempting the new install.

Resolution

1. Reboot the OS and reattempt upgrading from the CB Cloud Console.
2. If the same .msi error code 1603 happens when the installer is attempting to unload the driver, then choose an appropriate method to uninstall the sensor from the affected endpoint and then manually install the new sensor version.