Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Endpoint Standard: Background Scan Does Not Start On VDI Primary Image

Endpoint Standard: Background Scan Does Not Start On VDI Primary Image

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard
  • Carbon Black Cloud Sensor: 2.1 - 3.5.0.1154
  • Running the command "repcli ondemandscan" will return the following error message
C:\Program Files\Confer>repcli ondemandscan
Calling OnDemandScan with
OnDemandScan is disabled, due to this being a VDI Child environment

 

Symptoms

  • Sensor installed in primary image with VDI=1 parameter
  • Background scan never starts on virtual machines deployed from primary image

Cause

If the installation switch VDI=1 was used during the installation process, the background scan function will be disabled for the primary image and all children/clones

Resolution

To enable background scan on a primary image where VDI=1 has been used:
  1. Uninstall the sensor using these instructions
    (warning: any children deployed from the primary image will be subject to de-registration)
  2. Re-install the sensor without using VDI=1 and use the RepCLI re-registration process
  3. Once installed, move the new master image sensor into a policy that has background scan enabled
  4. Deploy child sensors to a policy that has background scan disabled

Additional Notes

  • This functionality will be changed in 3.5.0.1155+ sensors
  • Attempting to force a background scan by using repcli ondemandscan c: will not bypass the VDI=1 lock.

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
750
Contributors