BSOD Occurs when ELAM Enabled on Windows Agent 8.10.0

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When ELAM is enabled from group policy with "Good Only" enforcement, the endpoint will Blue Screen upon reboot.

Environment

• App Control Agent: 8.10.0
• Microsoft Windows: All Supported Versions

Cause

ParityELAM.sys driver classification causing INACCESSIBLE BOOT DEVICE when setting "Boot-Start Driver Initialization Policy" to "Good".

Resolution

This issue was tracked under EPCB-25080 and resolved with the release of Agent 8.10.2. Upgrading to 8.10.2 will prevent the issue.

Additional Information

• As a workaround, disable ELAM from Group Policy or set "Boot-Start Driver Initialization Policy" to "Good, unknown, bad but critical".
• Install or Upgrade the Rules or Agent Packages
• Methods to Upgrade the App Control Agent