VDIs are not being auto-deleted from Carbon Black Cloud console

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

VDIs are not being auto-deleted from Carbon Black Cloud console despite turning on the check boxes for auto-deregistration and deletion.

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Supported Versions

Cause

VDI clone instances that has had the re-registration script ran multiple times results in the clone becoming the parent which will not be Auto-Deregistrered.

Resolution

1. Find devices that can not be auto-deregistered on the Endpoints page using the following query.

   • vdiBaseDevice:* AND isBaseDevice:true

2. Sensor returned using the the above query will have to be manually uninstalling/deregistered. 

 

Additional Information

• After policy Auto-DeRegistered is configured it only takes affect moving forward.
• The customer can also add in criteria to find devices which have not checked in within a certain timeframe by modifying the search above to vdiBaseDevice:* AND isBaseDevice:true AND last_contact_time:<{EpochTimestamp}
• If this search alone ->  vdiBaseDevice:*    does not return the problem clone, it will not be auto-deregistered and the cloning proceess should be investigated.