Windows Server 2008 R2 SP1 fails to install 4.0.3 Windows sensor because of Azure Code Signing

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Workload
• Carbon Black Cloud Prevention

Issue/Introduction

Attempting to install 4.0.3 Windows sensor on Windows Server 2008 R2 SP1 fails with error:

CAStartService:  <DATE>: 8ec      ERROR     CAStartService: Service start failed : 183
CAStartService:  CustomActionManager::SetLastErrorMessage: Failed to start service
CAStartService:  <DATE>: 8ec      ERROR     Custom Action CAStartService failed. Failed to start service Return code : 1603
CAStartService:  <DATE>: 8ec      INFO      Ending custom action : CAStartService. Return value : 1603. 
CustomAction CustomActionId.StartService returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended <TIME>: InstallFinalize. Return value 3.

Environment

• Carbon Black Cloud Windows Sensor: 4.0.3 and Higher
• Microsoft Windows OS: 2008 R2 SP1 (not fully patched)

Cause

Starting in 4.x branch the Carbon Black Cloud Windows Sensor started using Azure Code Signing, now known as Trusted Signing, which requires all supported OS versions to be fully patched.

Resolution

Windows Server 2008 R2 SP1 servers need to be fully patched with all OS security updates. There are a few that could impact the use of Azure Signing Certs:

• KB5022661
• KB5006743
• KB5006728