Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Machines created from a master template with Bit9 have a disconnected kernel

Machines created from a master template with Bit9 have a disconnected kernel

Version

7.2.0.1492 (P7) to 7.2.0.1750 (P11)

7.2.1.710 (P3) and lower

 

Issue

When cloning a machine with the Bit9 Agent on it, the cloned machine starts up with the kernel disconnected.

 

Symptoms

  • Running dascli status returns an error "Cannot connect to user agent"
  • Running dascli status shows the version "0.0.0.0" for the Kernel
  • In the Bit9 Console, the agent appears with a red health check warning stating that the kernel is not connected

 

Solution

To fix the template so that any new clones do not run into this issue, please follow these steps:

  1. Restart master image
  2. Run the following commands via Command Prompt
    dascli password <pwd>
    dascli tamperprotect 0
    reg delete HKLM\System\CurrentControlSet\services\paritydriver\Parameters /v ParityAgentInstallPath /f
    reg delete HKLM\System\CurrentControlSet\services\paritydriver\Parameters /v ParityAgentDataPath /f
  3. Follow through the steps in the Using Bit9 Guide to mark this new image as a template in the Bit9 Console

 

To fix any machines that have already been cloned, please follow these steps:

  1. Run the following commands via Command Prompt
    dascli password <pwd>
    dascli tamperprotect 0
    net stop parity
    fltmc unload paritydriver
    reg delete HKLM\System\CurrentControlSet\services\paritydriver\Parameters /v ParityAgentInstallPath /f
    reg delete HKLM\System\CurrentControlSet\services\paritydriver\Parameters /v ParityAgentDataPath /f
    fltmc load paritydriver
    net start parity
  2. Reboot the machine
Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-18-2015
Views:
1413
Contributors