Carbon Black Cloud: Multiple devices reporting under the same device / registration ID

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Unable to find device hostname on the Carbon Black Cloud Console Endpoints Page
• Select the Investigate button for a device will return results for a different device hostname
• The URL on the Carbon Black Cloud Console Investigate Page will return the same device id for multiple devices e.g. [deviceId]=8168191

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Cause

The sensor was installed on a master image without the appropriate switch and then cloned

Resolution

• On a master image that is going to be cloned, the sensor must be installed with the appropriate switch for that device type: See https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
• For pre-existing devices which have already been cloned and deployed from a master image where the sensor was not installed with the appropriate switch, please take the following actions depending on the sensor version
  • Sensor Versions 3.4 and above: Run the reregister command described in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
    NOTE: The reregister command is not required for sensors running Horizon 7.13 and above.
  • Sensor Versions 3.1.x - 3.3.x: The sensor will need to be uninstalled and re-installed in order to correct this issue

Additional Information

• During the initial installation, each sensor is assigned a unique device registration ID by the Carbon Black Cloud
• The device id is preserved when a sensor is re-installed over an existing installation and also when the sensor is upgraded to a newer sensor version
• If the sensor is un-installed, the device id for that sensor installation will be deregistered
• If the sensor is re-installed, the Carbon Black Cloud server will generate a new unique device registration ID for the sensor
• VDI=1 is deprecated in sensor versions 3.4+.