MECM (SCCM) Errors with SoftDistHashMismatchEvent or ComputeContentHash Failed During Installs

Products

• Carbon Black App Control

Issue/Introduction

• Large applications (700MB or larger) are being pushed to the endpoint via MECM/SCCM.
• App Control Agent is not reporting any Block Events.
• Review of the CAS log file from MECM/SCCM may reference one of the following types of SoftDistHashMismatchEvent errors
  • ComputeContentHash failure example:

    Hash Mismatch Event:HashContent failed; 0x80070020
    ComputeContentHash failed; 0x80070020
    Failed to do hash verification with preference : 4
    SoftDistHashMismatchEvent event

  • Failed to hash file example:

    HashFile - exclusive access check for the file failed.
    Failed to hash file, Win32 error = 4103
    Failed to hash on directory C:\WINDOWS\ccmcache\XXXX
    Download failed for content XXXXXXXX under context System, error 0x80091007
    Download failed for download request {SOME-GUID-FOR-APPLICATION}

Environment

• App Control Agent: All Supported Versions
• Microsoft Endpoint Configuration Manager (SCCM)

Resolution

1. Verify Agent Exclusions are present in all other security products.
2. Verify the Microsoft SCCM Rapid Config is enabled.
3. Remove any Kernel Exclusion or Performance Optimization Rule relating to SCCM:
   1. Check for Performance Optimization Rules:
      
      1. Navigate to Rules > Software Rules > Custom > Show Filters
         • Action > Contains: Ignore
         • Path > Contains: sccm
      2. Click Apply.
      3. Disable any matching Custom Rule.
      4. Change the Filter to match:
         • Action > Contains: Ignore
         • Process > Contains: sccm
      5. Click Apply and disable any matching Custom Rule.
   2. Check for Kernel Exclusions:
      
      1. Navigate to https://ServerAddress/agent_config.php
      2. Click Show Filters
         • Value > Contains: sccm
      3. Click Apply
      4. Edit any resulting Kernel Exclusion to remove related SCCM path(s).
      5. Save any changes.
4. Upgrade the Agent to the latest version.
5. Verify Agent shows as Connected & Up to Date before re-testing.
6. If the issue persists, create the following Agent Config:
   
   1. Name: Increase Analysis Timeout
   2. Host ID: 0 (or specify a specific Host ID for testing)
   3. Value: (start with 122000, then 244000 if the issue persists):

      kernelMaxParityAnalysisStallMs=122000

   4. Platform: Windows
   5. Status: Enabled
   6. Create For: All Policies
7. After saving the changes, verify Agents show Connected & Up to Date before re-testing.

 

If the issue persists despite these changes:

1. Recreate the issue while capturing:
   
   • Agent Logs for Rules Not Working
   • Standard Procmon Capture
   • Microsoft Configuration Manager Logs:
     • CAS.log
     • CCMExec.log
     • DataTransferService.log
     • ContentTransferManager.log
2. Open a case with Support, include the captured logs and reference this article.