EDR: How to create a gold disk image for VDI Instant Clones

[#1]

Environment

• EDR (Formerly CB Response) Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Objective

To create a Gold Image that will ensure all new instances of VDI Instant Clones will check in as unique sensors to the EDR Server

Resolution

1. Create this batch file in the Gold Image, which should leave all clients with the ID of 0 when being forked:

   #stop cb service
   sc stop CarbonBlack
   
   # delete on-disk events
   del C:\Windows\CarbonBlack\EventLogs\eventlog_*.zip
   
   #Add in registry key to ensure that sensor gets reassigned a sensor ID
   reg add HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\config /f /v SensorId /d 0

2. Create a scheduled task for the SensorID reset in the Gold Image which runs above batch file as Action
3. Shutdown the Gold Image

Additional Notes

• When new instances spin up, they will now check in to get assigned a sensor ID
• To check this, navigate to the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\config and check the value of the Sensor ID 
• This sensor ID should be populated with a unique value

Related Content

EDR: Duplicate sensors due to misconfigured VDI
CB Response: How to configure VDI to match SID and Hostname