Endpoint Standard: Endpoints freeze after blocking svchost.exe

[#1]

Environment

• Carbon Black Cloud Console: All versions
• Endpoint Standard Sensor: 3.6 and above

Symptoms

Endpoints freeze after logging into machines

Cause

svchost handles many vital functions in Microsoft, by blocking the service, adverse effects occur

Resolution

1. Remove the block for svchost.exe in the policy settings
2. Bypass the endpoint Carbon Black Cloud: How to Enable/Disable Sensor Bypass on Sensors using Command Line (Windows)
3. Reboot the endpoint
4. Verify that the endpoint has updated since svchost was unblocked by checking the last update time of C:\Program Files\Confer\datafile1. If it is after svchost was unblocked, it should be updated
5. Once updated, remove the sensor bypass Carbon Black Cloud: How to Enable/Disable Sensor Bypass on Sensors using Command Line (Windows)