Endpoint Standard: Background Scan Does Not Start On VDI Primary Image

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Sensor installed in primary image with VDI=1 parameter
• Background scan never starts on virtual machines deployed from primary image

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard
• Carbon Black Cloud Sensor: 2.1 - 3.5.0.1154
• Running the command "repcli ondemandscan" will return the following error message

C:\Program Files\Confer>repcli ondemandscan
Calling OnDemandScan with
OnDemandScan is disabled, due to this being a VDI Child environment

 

Cause

If the installation switch VDI=1 was used during the installation process, the background scan function will be disabled for the primary image and all children/clones

Resolution

To enable background scan on a primary image where VDI=1 has been used:

1. Uninstall the sensor using these instructions

   (warning: any children deployed from the primary image will be subject to de-registration)

2. Re-install the sensor without using VDI=1 and use the RepCLI re-registration process
3. Once installed, move the new master image sensor into a policy that has background scan enabled
4. Deploy child sensors to a policy that has background scan disabled

Additional Information

• This functionality will be changed in 3.5.0.1155+ sensors
• Attempting to force a background scan by using repcli ondemandscan c: will not bypass the VDI=1 lock.