How to Restore an Accidentally Deleted Endpoint in the Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to display an Agent in the Console after it was accidentally deleted.

Environment

• App Control Console: All Supported Versions

Cause

An Agent can only be removed from Assets > Computers when it is in a Disconnected state. This could have be done manually using the Delete option, or automatically through the use of Old Computer Cleanup.

Resolution

REMINDERS:

• An Agent being removed from Assets > Computers will not prevent it from reconnecting to the Server.
• These steps will not restore the Agent's connection, nor are they required to restore the connection.
  • An Agent will automatically be added back to the Console after the connection is restored.
  • These steps will only show the Agent in Assets > Computers.
• These steps will only work if the Agent reference still remains in the database.

 

1. Run SQL Server Management Studio as the Carbon Black Service Account.
2. Use the following query to verify the deleted computer still exists in the database (replace 'COMPUTERNAME' with the name of the deleted agent):

   USE das; SELECT host_id, hostname, date_deleted FROM dbo.hostmain (NOLOCK) WHERE hostname LIKE '%COMPUTERNAME%' AND deleted=1;
   

3. Restore the deleted computer using the value for 'host_id' returned in the previous query: 

   USE das; UPDATE dbo.hostmain SET deleted=0, delete_date = NULL WHERE host_id = 'host_id'