Carbon Black Cloud: Multiple devices reporting under the same device / registration ID
book
Article ID: 289502
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Unable to find device hostname on the Carbon Black Cloud Console Endpoints Page
Select the Investigate button for a device will return results for a different device hostname
The URL on the Carbon Black Cloud Console Investigate Page will return the same device id for multiple devices e.g. [deviceId]=8168191
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Sensor: All Supported Versions
Microsoft Windows: All Supported Versions
Apple MacOS: All Supported Versions
Cause
The sensor was installed on a master image without the appropriate switch and then cloned
Resolution
On a master image that is going to be cloned, the sensor must be installed with the appropriate switch for that device type: See https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
For pre-existing devices which have already been cloned and deployed from a master image where the sensor was not installed with the appropriate switch, please take the following actions depending on the sensor version
Sensor Versions 3.4 and above: Run the reregister command described in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
NOTE: The reregister command is not required for sensors running Horizon 7.13 and above.
Sensor Versions 3.1.x - 3.3.x: The sensor will need to be uninstalled and re-installed in order to correct this issue
Additional Information
During the initial installation, each sensor is assigned a unique device registration ID by the Carbon Black Cloud
The device id is preserved when a sensor is re-installed over an existing installation and also when the sensor is upgraded to a newer sensor version
If the sensor is un-installed, the device id for that sensor installation will be deregistered
If the sensor is re-installed, the Carbon Black Cloud server will generate a new unique device registration ID for the sensor