When trying to open a third party application, and that application needs to open any network drive or file, the application is slow or unable to function properly.
VMware Carbon Black EDR (Formerly Response)
There is no specific resolution for this type of issue. VMware support has observed that it can be related to:
- Network driver issues.
- Old sensor file versions.
One test would be to disable the network drive by following the steps below:
- To disable the driver run the below command from an elevated command prompt.
sc config cbstream start=disabled
- Reboot the endpoint, after the reboot to know the status of the driver, run the below command:
sc query cbstream
- Test by working on your application and see if the issue can be replicated.
- Record your findings and provide the data to Red Canary Support for assistance.
- Once your testing is over, change the start option to auto by running the below command:
sc config cbstream start=auto
For older sensor versions please update to the latest as soon as possible as performance improvements are implemented by VMware regularly.