Carbon Black Cloud: Sensor is uninstalled when the Horizon instant clone comes online

[#1]

Environment

• Carbon Black Cloud Sensor: 3.8.x and higher versions
• Microsoft Windows: All Supported Versions
• VMware Horizon 8: And Newer
• Instant Clone Desktop Pools: All Supported Versions

Symptoms

When a VDI from a Horizon Instant Clone Desktop Pools comes online, the Carbon Black sensor is uninstalled, and removed from the CBC console.

Cause

The CBC environment is configured to automatically uninstall agents from VDIs when their associated golden image or 'internal template' has been deleted from the CBC Console.

Resolution

The following steps should reveal why the device was deleted:

1. Verify Golden Image Presence:
   1. In the CBC console, go to Inventory > Endpoints.
   2. Search for the golden image by name.
   3. If found, note its device ID.
   4. If not found, skip the next step.
2. Verify the "Internal Template" Presence:
   1. In Inventory > Endpoints, search using:

      vdi_base_device: <Golden_Image_Device_ID>

3. Investigate Missing Devices:
   1. Search the CBC console's Audit Logs using the device ID or name of the missing golden image or "internal template".
4. Address Automated Deletion (if applicable):
   1. If the “internal template” is getting auto deleted, reference Horizon instan clone Internal templates are auto deregistered and eventually deleted.

Additional Notes

• For the 'golden_device_id' field, the 'internal template' and the instant clones will have the device ID of the golden image.
• An “internal template” (that follows this naming format: `ITXXXXXX`)

Related Content

docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-sensor-installation-guide/GUID-3E57AAEB-21...

kb.vmware.com/s/article/79180