Local Scanner Fails to Initialize on Windows 11 ARM64 with Sensor 4.1.0

Products

• Carbon Black Cloud Endpoint Standard

Issue/Introduction

When deploying Carbon Black Cloud (CBC) Windows Sensor version 4.1.0 on devices running Windows 11 ARM64 the following symptoms may occur:

• Local Scanner Status: Remains in a "Not Ready" or "Disabled" state indefinitely.
• Signature Update Error: Running RepCLI.exe localscanner updatesignature -wait returns Error: Failed to start local scanner.
• Empty Signature Version: The console or RepCLI status shows an empty signature version despite the device being active.
• Alarms: High volume of Assertions and AvatarScanHostReportError alarms in the sensor logs.

Environment

• Operating System: Windows 11 for ARM64
• Carbon Black Cloud Windows ARM64 Sensor: 4.1

Cause

• Carbon Black Cloud Sensor 4.1.0 and higher utilizes the Symantec STARgate scanning engine. This engine replaces the Avira engine used in version 4.0.3 and earlier.
• On Windows 11 ARM64 architecture, the STARgate engine may fail to initialize due to missing environment dependencies or connectivity requirements specific to the STARgate platform.

Resolution

• Adjust emulation settings on ARM.
• Downgrade to 4.0.3

Additional Information

• This will be addressed in our upcoming Windows 4.2 Sensor release.