McAfee Endpoint Encryption v18.104.22.168 incompatible with Carbon Black Enterprise Response Sensor
Version This solution applies to all Carbon Black Enterprise Response Sensor versions, and specifically McAfee Endpoint Encryption for Files and Folders (EEFF) v22.214.171.124.
With both a Cb Response Sensor and McAfee Endpoint Encryption for Files and Folders v126.96.36.199 product installed on a Windows host, the system will hang on reboot.
Cause The cause of the issue is a bug in McAfee's EEFF v188.8.131.52 MfeEEFF.sys driver causing deadlock. The minifilter driver's calls from the InstanceSetupCallback routine result in a kernel ERESOURCE thread deadlock, which causes the system boot hanging symptom.
The solution is to remove the McAfee EEFF product. Then reboot the system to confirm the symptom is resolved and system boot is successful.
It is unclear if the latest version of the McAfee EEFF product resolves this issue.