Windows 11 cumulative update failure with Carbon Black EDR and Utimaco LanCrypt

Products

• Carbon Black EDR

Issue/Introduction

When installing Windows 11 cumulative updates (offline MSU files), the process may fail due to a race condition. This occurs when the Carbon Black EDR sensor (cb.exe) asynchronously hashes or analyzes files in C:\Windows\CbsTemp while they are being moved or renamed by the Windows Update process (TiWorker.exe). This behavior is often triggered by the presence of third-party filter drivers like Utimaco LanCrypt.

Symptoms:

• Windows Update fails with file access or "File in use" errors.
• ProcMon identifies cb.exe and TiWorker.exe accessing the same .exe or .dll files in C:\Windows\CbsTemp simultaneously.

Environment

• Carbon Black EDR Sensor: 7.5.0 and earlier
• Microsoft Windows: 11
• Third-Party Software: Utimaco LanCrypt

Cause

The "File modifications" (binary recording) setting triggers a hash lookup immediately upon file modification. If the LanCrypt filter driver introduces latency, the cb.exe access window overlaps with the OS update process, causing a race condition during file renames.

Resolution

A permanent fix is targeted for release in Windows sensor version 7.6.0 (Enhancement CB-49271). To receive updates on this release, please subscribe to this article (Reference: How to subscribe to Knowledge Management Content updates).

Workarounds:

Option 1: Disable Binary Modification Recording

1. Navigate to the EDR Console > Sensors > Groups.
2. Select the policy for the impacted endpoints.
3. In Event Collection, locate File modifications.
4. Disable Record modifications of binary files (e.g., .exe, .dll).
5. Save and sync the policy.

Option 2: Implement Targeted Wildcard Exclusions Exclusions must follow specific normalization and syntax rules to be effective against the TiWorker.exe race condition:

1. Case Sensitivity: All path and process exclusions are case-sensitive. Ensure the case matches the OS path exactly.
2. Valid DOS Paths: User-mode exclusions require a valid DOS path (e.g., C:\...) so the sensor can perform path normalization.
3. Wildcard Usage:
   • Middle Wildcards: Supported in patterns like C:\Windows\*\TiWorker.exe.
   • Leading Wildcards: Using a * at the start (e.g., *\TiWorker.exe) allows the sensor to absorb the \Device\HarddiskVolumeN portion of the normalized path.
   • Path Examples:
     • C:\Windows\System32\TiWorker.exe (Exact match)
     • C:\Windows\*\TiWorker.exe (Wildcard match for versioned or dynamic folders)
4. Reference Guidelines: See Create Windows Exclusions for Carbon Black EDR for additional syntax details.

 

Additional Information

If the update still fails after applying exclusions, verify that no other processes are driving the problematic file renames in C:\Windows\CbsTemp.

For further assistance, contact Broadcom Support.