Can you recover an ATP or SEDR VM after you have expanded Hard Disk 1?

book

Article ID: 171260

calendar_today

Updated On:

Products

Endpoint Detection and Response Advanced Threat Protection Platform

Issue/Introduction

When preparing the SEDR VM for using Endpoint Activity Recorder, Hard Disk 1 was expanded to 1,500 GB in an attempt to meet the required specifications.

Cause

The steps for extending the Appliance storage calls for an extra hard drive to be added before running the 'extend_storage' command.

Resolution

There is no way to recover the space incorrectly allocated to Hard Disk 1. The SEDR software cannot be guaranteed to function correctly if Hard Disk 1 gets modified. Since this is an unsupportable condition, the VM will need to be redeployed and a Hard Disk 2 with a size of between 1 and 2TB be added for the Endpoint Activity Recorder on the new SEDR VM.

Please refer to the Virtual Appliance installation workflow for the correct deployment steps: https://help.symantec.com/cs/SymantecEDR_4.3/EDR/v133549683_v133952674/Virtual-appliance-installation-workflow

Attachments