Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Unable to save work to a network (SMB/DFS) drive unless "save" button selected twice

Carbon Black Cloud: Unable to save work to a network (SMB/DFS) drive unless "save" button selected twice

Environment

  • CBC Sensor: All versions
  • CBC Console: All versions
  • Microsoft Windows: All versions

Symptoms

  • Common Windows tools (notepad.exe, textpad.exe, excel.exe) silently fail to save work to a network file share.
  • If the user tries to "save" twice, the second attempt works.
  • If the CBC sensor is placed into Bypass mode, the problem disappears.

Cause

  1. The Windows computer is also running Trend Micro sensor.
  2. This is Trend Micro defect where Trend added the following to the Data Protection Policy (DLP)
File: C:\Windows\System32\dgagent\dsa.pro
Added Line: smb_disable_get_long_path_name=true
Trend Agent: ApexOne (SaaS)
Trend Internal tracking number:  Trend Case:05427594

Resolution

Trend Micro has supplied a fix, so contact their Support directly.

Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-14-2022
Views:
151
Contributors