CB Defense: Endpoint shows multiple deregistered instances without corresponding audit logs

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Console shows multiple sensors for the same endpoint as deregistered
• Sensors may have registered several minutes apart

Environment

• CB PSC Web Console
• CB Defense Sensor: All Versions
• Microsoft Windows: All Supported Versions

Cause

The sensor failed to complete install multiple times. With each install attempt, the failed device was deregistered in the UI

Resolution

If the sensor still has not successfully registered with the server, the underlying install issue will need to be addressed

Additional Information

• Deregistered devices can be removed automatically after a set number of days
• If performing an unattended install, a flag can be added to save the installation to a log for further troubleshooting on failed installations
• If a sensor in the UI does not show details such as the operating system and sensor version, the sensor has not successfully installed