Delete Application Showing Success in Inbox - But Not Being Deleted

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Using the "Delete application" button in the Carbon Black Cloud console for a path that is on a remote file share (Ex \\Servername\Share\file.exe)
• Settings > Inbox shows "Success" for the delete
  
• Settings > Audit Log shows "Success deleting hash '<Sha256hash>' off of device '<DeviceId>'at path '<Path>'. Reason: FILE_NOT_FOUND
  

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

When the sensor tries to delete the file off the remote file share, the Operating System of the device where the sensor is installed tries to connect over SMB and delete the file as "System". If System does not have access to the file, then the deletion will fail. In this situation the "Success" in the Inbox is incorrectly being reported.

Resolution

The issue with incorrect reporting within the Inbox is being investigated under CRE-22108