Carbon Black Cloud: Multiple devices reporting under the same device / registration ID
search cancel

Carbon Black Cloud: Multiple devices reporting under the same device / registration ID

book

Article ID: 289502

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Unable to find device hostname on the Carbon Black Cloud Console Endpoints Page
  • Select the Investigate button for a device will return results for a different device hostname
  • The URL on the Carbon Black Cloud Console Investigate Page will return the same device id for multiple devices e.g. [deviceId]=8168191

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions
  • Apple MacOS: All Supported Versions

Cause

The sensor was installed on a master image without the appropriate switch and then cloned

Resolution

  • On a master image that is going to be cloned, the sensor must be installed with the appropriate switch for that device type: See https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
  • For pre-existing devices which have already been cloned and deployed from a master image where the sensor was not installed with the appropriate switch, please take the following actions depending on the sensor version
    • Sensor Versions 3.4 and above: Run the reregister command described in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-Sensor-to-a-Non-Persistent-VDI/ta-p/62240 for details
      NOTE: The reregister command is not required for sensors running Horizon 7.13 and above.
    • Sensor Versions 3.1.x - 3.3.x: The sensor will need to be uninstalled and re-installed in order to correct this issue

Additional Information

  • During the initial installation, each sensor is assigned a unique device registration ID by the Carbon Black Cloud
  • The device id is preserved when a sensor is re-installed over an existing installation and also when the sensor is upgraded to a newer sensor version
  • If the sensor is un-installed, the device id for that sensor installation will be deregistered
  • If the sensor is re-installed, the Carbon Black Cloud server will generate a new unique device registration ID for the sensor
  • VDI=1 is deprecated in sensor versions 3.4+.