This metric records GDI handles usage from the Carbon Black EDR Windows sensor service. GDI handles are used in module extraction only.


Carbon Black EDR sensor service GDI handle usage is above normal values.

Severity Scale

GDI handles

Health score


> 100


High GDI handle count

> 500


Very high GDI handle count

> 1000


Excessive GDI handle count


Analyze event collection to see if a specific event type is generating an excessive count. If these are non-binary file writes, this collection type can be often be turned off. See Turn off Event Collection of Non-binary File Writes.