Carbon Black Cloud: Unable to open explorer.exe, regedit, or iexplore.exe

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows Sensor: 3.4.0.1040 and above
• Microsoft Windows: Microsoft Windows 10 

Symptoms

• If sensor is enabled (not in bypass) after device boot, explorer.exe, regedit, or iexplore.exe will not open 
• If sensor is enabled before device reboot, explorer.exe will not open. Sensor must be put into bypass from the console to get the Windows task bar back

Cause

This issue can occur if if McAfee IPS is enabled

Resolution

• Enabling McAfee IPS Adaptive Mode 

OR

• To Disable McAfee IPS

1. Open the "McAfee Host Intrusion Prevention Console" on the Device: Path: C:\Windows\Program files\McAfee\Host Intrusion Prevention\McAfeeFire.exe
2. Step 2. Go to the IPS Policy tab > Uncheck "Enable Host IPS

Note: From the McAfee Server Console you can "Enable Adaptive Mode" without enabling "Enable Host IPS"

Related Content

Carbon Black Cloud: How to Get Started With Bypass Mode