Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

Environment

  • Carbon Black Cloud Sensor: All Windows versions 3.5.x, 3.6.0+
  • Carbon Black Cloud Console: All Versions

Symptoms

  1. Windows applications randomly stop or hang, ranging from hours to days between events.
  2. Problem seems to be worse on busier machines.
  3. Problem occurs on wide range of Windows OS's.
  4. Restarting the Windows WMI service fixes the hanging.
  5. Placing the sensor host in Bypass mode fixes the hanging.
  6. Running this get-process command from a powershell for the wmiPrvSE.exe process ID returns almost all  "Suspended" states:
username> (get-process -id 1234).threads.waitreason
Suspended
Suspended
Suspended
Unknown
Suspended
Suspended
.
.
.

Cause

This is issue DSEN-13250.

Resolution

To address this "app-hook" issue hanging the WMI service, add an API Bypass rule as so:
  1. Edit the policy for the target Windows sensor hosts
  2. Prevention Tab; Permissions; Check "Performs any API operation" and  Application(s) at Path:   
*:\Windows\Sys*\wbem\WmiPrvSE.exe

Additional Notes

Note that the API bypass will only prevent future occurrances and not "heal" sensor hosts currently in a bad state.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-02-2021
Views:
307