Performance issues when third party application opening network files with Carbon Black EDR – Red Canary Support

Issue

When trying to open a third party application, and that application needs to open any network drive or file, the application is slow or unable to function properly.

Environment

VMware Carbon Black EDR (Formerly Response)

Resolution

There is no specific resolution for this type of issue. VMware support has observed that it can be related to:

Network driver issues.
Old sensor file versions.

One test would be to disable the network drive by following the steps below:

To disable the driver run the below command from an elevated command prompt.
```
sc config cbstream start=disabled
```
Reboot the endpoint, after the reboot to know the status of the driver, run the below command:
```
sc query cbstream
```
Test by working on your application and see if the issue can be replicated.
Record your findings and provide the data to Red Canary Support for assistance.
Once your testing is over, change the start option to auto by running the below command:
```
sc config cbstream start=auto
```

For older sensor versions please update to the latest as soon as possible as performance improvements are implemented by VMware regularly.