Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Endpoint Standard: WSC Integration Service Won't Start on Windows Servers

Endpoint Standard: WSC Integration Service Won't Start on Windows Servers

Environment

  • Endpoint Standard Sensor: Version 2.1.x.x and higher
  • Microsoft Windows: All supported versions

Symptoms

  • Carbon Black Cloud WSC service (CbDefenseWSC) fails to start after upgrading or installing Cb Defense sensor version 3.2.0.213 even when "Use Windows Security Center" policy is enabled
  • Upon attempting to start the service manually, a message is displayed, similar to: "The Carbon Black Cloud WSC service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs".
  • System log in Event Viewer shows the following entries:
Log Name: System
Source: Service Control Manager
Event ID: 7036
The Carbon Black Cloud Sensor WSC service entered the running state.
Log Name: System
Source: Service Control Manager
Event ID: 7036
The Carbon Black Cloud Sensor WSC service entered the stopped state.

Cause

Carbon Black Cloud Sensor WSC service has a dependency on Microsoft's Windows Security Center; if it is not present then Cb Defense WSC will not start.

Resolution

The Windows Security Center is not installed by default in server-class operating systems. To verify the presence of Windows Security Center:

1. Run the following command from the command line interpreter:

sc query wscsvc

2. Should the Security Center service be missing (see example below), the Carbon Black Cloud Sensor WSC service will not start

[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service

Additional Notes


Related Content


Was this article helpful? Yes No
75% helpful (3/4)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
7625
Contributors