Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Multiple devices reporting under the same device / registration ID

Carbon Black Cloud: Multiple devices reporting under the same device / registration ID

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions
  • Apple MacOS: All Supported Versions

Symptoms

  • Unable to find device hostname on the Carbon Black Cloud Console Endpoints Page
  • Select the Investigate button for a device will return results for a different device hostname
  • The URL on the Carbon Black Cloud Console Investigate Page will return the same device id for multiple devices e.g. [deviceId]=8168191

Cause

The sensor was installed on a master image without the appropriate switch and then cloned

Resolution

  • On a master image that is going to be cloned, the sensor must be installed with the appropriate switch for that device type: See Carbon Black Cloud: How to Deploy Sensor to a Non-Persistent VDI Master Image for details
  • For pre-existing devices which have already been cloned and deployed from a master image where the sensor was not installed with the appropriate switch, please take the following actions depending on the sensor version

Additional Notes

  • During the initial installation, each sensor is assigned a unique device registration ID by the Carbon Black Cloud
  • The device id is preserved when a sensor is re-installed over an existing installation and also when the sensor is upgraded to a newer sensor version
  • If the sensor is un-installed, the device id for that sensor installation will be deregistered
  • If the sensor is re-installed, the Carbon Black Cloud server will generate a new unique device registration ID for the sensor
  • VDI=1 is deprecated in sensor versions 3.4+.

Related Content


Was this article helpful? Yes No
50% helpful (1/2)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
3430