I have users who are seeing a makecab.exe popup window


It seems like it coincides with the deployment of patches through Dell Kace to the client.

I would like to confirm if this is a by-product of the Dell Kace patch deployment, and is there any way to get it so this window does not pop up, and if it needs to run, can we keep it minimized or running in the background without the user knowing?
5 Comments   [ + ] Show Comments


  • I have the same problem when I try to use the K1000 to patch. I see dozens of those CbsPersist windows on my test workstation.
  • Getting the same thing, but only on one domain. We have two KACE appliances and two domains with some overlap. I'm only seeing these makecab windows pop up on one of our domains. Very weird, hope someone finds a solution! They can just be minimized, but I don't want users to freak out.
  • It seems like I am not the only one... has anyone else seen this and have been able to work around this?
  • We just saw this as well in our org. Install agent, detect and deploy patches, 15 CbsPersis windows for log compression/decompression. I understand that this is part of th enormal deployment process, I'm just confused why we're seeing the windows. I don't see any other info in the forums - any update from anyone who has opened a ticket on this?
  • I have the same problem. On my Win8 and Win10 machines the deployment works without issues, but on the Win7 machine I get 4 of those windows, until each reaches 100%, then I get 4 new ones. My CPU is running at 100% while this is happening and I see about 30 "makecab.exe" and "conhost.exe" processes in the taskmanager... Anyone heard of a solution?
Please log in to comment


I wrote to the support about this issue and was told, the problem is probably caused by the OS and you would experience the same issues with any other patching appliance. 
You can check "C:\Windows\logs\cbs" for big log files and delete or move them (on a normally funcitoning system there should only be small logs). However, you should check your system anyway (starting with sfc /scannow). 
The support supposed that the cmd boxes appear, because some logs (which are allways created while patching) are too big and have to be "log rotated" (=archived ?) first.

Answered 02/06/2017 by: Christian1616
White Belt

Please log in to comment
Answer this question or Comment on this question for clarity