Environment
- App Control Agent: All Supported Versions
- Tanium Driver (Threat Response, Integrity Monitor, or Enforce Modules)
- Microsoft Windows: All Supported Versions
Symptoms
- App Control Agent disconnected in the Console
- Viewing services shows the Agent's service stuck in "Starting" state
- Performance issues on the endpoint
Cause
- A new feature in Tanium's Driver (TaniumRecorderDrv) is interacting with the Agent's Tamper Protection in an unexpected manner.
- Once the system is rebooted, and the updated driver is loaded, the issues begin.
Resolution
Tanium and Carbon Black have worked together to resolve this issue. Customers running App Control and Tanium together should:
- Upgrade Tanium to version 4.0.1116+ or 4.2.29+
- Upgrade App Control to Agent version 8.9.2+
Additional Notes
- Upgrading either application to the versions above will resolve this issue.
- Customers that are unable to upgrade are encouraged to reach out to their Tanium TAM and reference DRIVER-252, and contact Carbon Black Support for additional steps.
Related Content
