Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

[#1]

Environment

• Carbon Black Cloud Sensor: All Windows versions 3.7.x and earlier
• Carbon Black Cloud Console: All Versions

Symptoms

1. Windows applications randomly stop or hang, ranging from hours to days between events.
2. Problem seems to be worse on busier machines.
3. Problem occurs on wide range of Windows OS's.
4. Restarting the Windows WMI service fixes the hanging.
5. Placing the sensor host in Bypass mode fixes the hanging.
6. Running this get-process command from a powershell for the wmiPrvSE.exe process ID returns almost all  "Suspended" states:

username> (get-process -id 1234).threads.waitreason
Suspended
Suspended
Suspended
Unknown
Suspended
Suspended
.
.
.

Cause

This is issue DSEN-13250. T

Resolution

This issue is fixed in 3.8.x Windows sensors.

To address this "app-hook" issue hanging the WMI service for 3.7.x sensors and earlier , add an API Bypass rule as so:

1. Edit the policy for the target Windows sensor hosts
2. Prevention Tab; Permissions; Check "Performs any API operation" and  Application(s) at Path:   

*:\Windows\Sys*\wbem\WmiPrvSE.exe

Additional Notes

Note that the API bypass will only prevent future occurrences and not "heal" sensor hosts currently in a bad state.

 

Related Content

How to restart the WMI service:
Starting and Stopping the WMI Service - Win32 apps