Endpoint Standard: Number of deregistered sensors keeps growing

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

The number of deregistered sensors keeps growing with many sensors having multiple entries.

Environment

• Endpoint Standard: All versions
• Microsoft Windows: All Supported Versions

Cause

When SCCM is used to upgrade sensors it will continue to try to uprgrade a failed installation and this can result in a de/re-registration cycle causing the increase in deregistered sensor numbers.

Resolution

SCCM job needs to be modified to stop upgrade attempts after a certain number of fails.