Carbon Black Cloud: VDIs are not being auto-deleted

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

VDI sensors are not auto deregistering

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Supported Versions

Cause

VDI clone instances that has had the re-registration script ran multiple times results in the clone becoming the parent which will not be Auto-Deregistrered.

Resolution

1. Find devices that can not be auto-deregistered on the Endpoints page using the following query.

   • vdiBaseDevice:* AND isBaseDevice:true

2. Sensor returned using the the above query will have to be manually uninstalling/deregistered. 

 

Additional Information

• After policy Auto-DeRegistered is configured it only takes affect moving forward.
• The customer can also add in criteria to find devices which have not checked in within a certain timeframe by modifying the search above to vdiBaseDevice:* AND isBaseDevice:true AND last_contact_time:<{EpochTimestamp}
• If this search alone ->  vdiBaseDevice:*    does not return the problem clone, it will not be auto-deregistered and the cloning proceess should be investigated.