Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: VDIs are not being auto-deleted

Carbon Black Cloud: VDIs are not being auto-deleted

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All Supported Versions

Symptoms

VDI sensors are not auto deregistering

Cause

VDI clone instances that has had the re-registration script ran multiple times results in the clone becoming the parent which will not be Auto-Deregistrered.

Resolution

  1. Find devices that can not be auto-deregistered on the Endpoints page using the following query.
    • vdiBaseDevice:* AND isBaseDevice:true
  2. Sensor returned using the the above query will have to be manually uninstalling/deregistered


 

Additional Notes

  • After policy Auto-DeRegistered is configured it only takes affect moving forward.
  • The customer can also add in criteria to find devices which have not checked in within a certain timeframe by modifying the search above to vdiBaseDevice:* AND isBaseDevice:true AND last_contact_time:<{EpochTimestamp}
  • If this search alone ->  vdiBaseDevice:*    does not return the problem clone, it will not be auto-deregistered and the cloning proceess should be investigated.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-11-2022
Views:
517
Contributors