Environment
- Carbon Black Cloud Sensor: 3.8.x and higher versions
- Microsoft Windows: All Supported Versions
- VMware Horizon 8: And Newer
- Instant Clone Desktop Pools: All Supported Versions
Symptoms
When a VDI from a Horizon Instant Clone Desktop Pools comes online, the Carbon Black sensor is uninstalled, and removed from the CBC console.
Cause
The CBC environment is configured to automatically uninstall agents from VDIs when their associated golden image or 'internal template' has been deleted from the CBC Console.
Resolution
The following steps should reveal why the device was deleted:
- Verify Golden Image Presence:
- In the CBC console, go to Inventory > Endpoints.
- Search for the golden image by name.
- If found, note its device ID.
- If not found, skip the next step.
- Verify the "Internal Template" Presence:
- In Inventory > Endpoints, search using:
vdi_base_device: <Golden_Image_Device_ID>
- Investigate Missing Devices:
- Search the CBC console's Audit Logs using the device ID or name of the missing golden image or "internal template".
- Address Automated Deletion (if applicable):
- If the “internal template” is getting auto deleted, reference Horizon instan clone Internal templates are auto deregistered and eventually deleted.
Additional Notes
- For the 'golden_device_id' field, the 'internal template' and the instant clones will have the device ID of the golden image.
- An “internal template” (that follows this naming format: `ITXXXXXX`)
Related Content