How to Stop the Symantec CBX Agent and Disable Kernel-Level Drivers

Products

CBX Complete CBX Essentials

Issue/Introduction

You need to stop the Symantec CBX Agent services and disable kernel-level drivers on a Windows endpoint for troubleshooting or system maintenance.

This article is intended for use in troubleshooting scenarios where interoperability (inter-op) issues are suspected between the CBX Agent and third-party software, hardware, or OS-level components. If an issue is resolved after disabling these drivers, it serves as a strong indicator of a compatibility conflict. Please document these findings and provide them to Broadcom Support to expedite further analysis.

Environment

Product: Symantec CBX (Complete/Essentials)
Operating System: Microsoft Windows

Resolution

Procedure

Step 1: Stop the CBX Agent Service

Open an Administrative PowerShell or Command Prompt.
Navigate to the installation directory.
- Path: C:\Program Files\Broadcom\Endpoint Security Agent\[Version]\bin64
- Note: The version folder (e.g., 2.10.0.8) varies based on your release. Check the directory name on your system and adjust the path accordingly.
Stop the agent service using the following command (requires your system policy password):
```
.\agentcli.exe service stop --password <YOUR_PASSWORD>
```

Step 2: Disable Kernel Drivers

Stopping the agent service does not unload kernel-level drivers. To prevent them from reloading upon the next system restart, disable their startup type.

Important: Before disabling the SE driver or renaming the SymEFASI driver, you must disable Tamper Protection in the management console:

Navigate to: System Policy > Tamper protection > Protect Symantec security software from being tampered with or shutdown.
Failure to disable this policy will result in "Access Denied" errors when attempting to modify these files or services.

For standard drivers, run the following commands in an Administrative Command Prompt:

sc config BHDrvx64 start= disabled
sc config SE start= disabled
sc config eeCtrl start= disabled
sc config SRTSP start= disabled
sc config ctinet start= disabled
sc config ctifile start= disabled
sc config bfs start= disabled

For SymEFASI (Symantec Extended File Attributes), rename the driver binary to prevent it from loading:
- Navigate to: C:\Windows\System32\drivers\symefasi\[Version]\
- Note: The version folder (e.g., 0708000.004) varies by installation. Locate the correct folder on your system before proceeding.
- Rename symefasi64.sys to symefasi64.sys.bak.
Reboot the machine to apply these changes.

Step 3: Verification

After the reboot, verify the driver status by querying the driver services:

sc query BHDrvx64

The STATE should report 1 STOPPED.

Re-enabling Security

Restore SymEFASI:
- Navigate to the version-specific C:\Windows\System32\drivers\symefasi\[Version]\ folder.
- Rename symefasi64.sys.bak back to symefasi64.sys.

Restore Driver Startup: Set the startup type back to system:

sc config BHDrvx64 start= system
# (Repeat for each standard driver listed in Step 2)

Start the Agent Service: Navigate to the version-specific installation directory and run:
```
.\agentcli.exe service start
```
Reboot the system to finalize the restoration of all drivers.
Re-enable Tamper Protection: Return to the Management Console (System Policy > Tamper protection > Protect Symantec security software from being tampered with or shutdown) and re-enable the policy to harden the agent against unauthorized changes.

Additional Information

Best Practice Note

Use the Management Console to apply a system policy that disables or removes features one by one, as this is the primary method for modifying agent behavior. The Broadcom Support team may specifically instruct you to use these policies as a non-intrusive alternative to disabling drivers. Manual disabling of kernel-level drivers is a high-risk operation that can lead to system instability and should only be performed when explicitly requested by the Broadcom Support team.