**Important Note** A small number of customers have reached out to support indicating that they have experienced a situation in which some hosts running 6.1.4 have become unresponsive after sensor upgrade. For more details see our UeX post herePotential Stability Issue for 6.1.4 Windows Sensor
General Availability of 6.1.4-win (on-prem) has been pushed to Friday March 16th
[UPDATED 3/14/18 at 11:07AM (ET)]
The Cb Response team is getting set to release our 6.1.4 Windows sensor as generally available. Below are the targeted on-prem/cloud release dates for our upcoming 6.1.4-win Cb Response sensor:
~ The Cb Response team
[UPDATED 2/8/18 at 11:13AM (ET)]
Our internal testing of the 6.1.3 Windows sensor identified issues and limitations with suppression and reporting command line information for processes that we believe to have a critical impact on expected behavior. As such, the 6.1.3 Windows sensor will not be made available for Controlled Distribution as previously stated.
We are working to resolve these known issues in our follow up 6.1.4 Windows sensor release that will be made available as soon as we can provide it. Please open a case with our support team if you believe to be experiencing this issue.
The Cb Response team
[UPDATED 2/1/18 at 8:53AM (ET)]
We are planning to make our 6.1.3 windows sensor available for controlled distribution next week. The sensor release will contain improvements to prevent a bug check from occurring should this same issue be observed.
The development team is still working to fully ascertain why this failed driver initialization is occurring. This bugcheck issue is sporadic. This does not impact a particular Windows OS version more so than others. The bug check is typically observed at the time of installation or very shortly thereafter. If no issues have been observed with the 6.1.2 sensor in your environment there is no need to revert back to an older sensor version. We encourage testing on 6.1.3 and future maintenance releases as they become available as we continue to make improvements to address this issue and others.
The Cb Response Team
We have learned that installing the Windows 6.1.2 Response sensor may lead to a stop error (Blue Screen of Death) for some environments.
The issue is due to an unexpected failure during driver startup that results in the DriverEntry() function exiting early, preventing a full initialization of the driver. We believe this issue could potentially be related to other security products running on the endpoint. There are potential scenarios where one of these products could prevent access to certain system directories, such as ‘Windows’ and / or ‘Windows\System32’. This would result in a driver initialization failure, triggering a cleanup code path that is usually called only after the driver has been fully initialized. Since the driver has not been fully initialized, the sensor ends up attempting to use uninitialized objects which results in a bug check.
For customers experiencing this issue, or believe to be a candidate, we recommend using the previous 6.0.3 windows sensor until a fix can be provided. We are working to address this issue in a follow up maintenance release that will be made available as early as possible. As always, be sure to test the newest version of the sensor on a representative subset of computers before deploying it to the entire enterprise.