Sensor is uninstalled when the Horizon instant clone comes online

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

When a VDI from a Horizon Instant Clone Desktop Pools comes online, the Carbon Black sensor is uninstalled, and removed from the CBC console.

Environment

• Carbon Black Cloud Sensor: 3.8.x and higher versions
• Microsoft Windows: All Supported Versions
• VMware Horizon 8: And Newer
• Instant Clone Desktop Pools: All Supported Versions

Cause

The CBC environment is configured to automatically uninstall agents from VDIs when their associated golden image or 'internal template' has been deleted from the CBC Console.

Resolution

The following steps should reveal why the device was deleted:

1. Verify Golden Image Presence:
   1. In the CBC console, go to Inventory > Endpoints.
   2. Search for the golden image by name.
   3. If found, note its device ID.
   4. If not found, skip the next step.
2. Verify the "Internal Template" Presence:
   1. In Inventory > Endpoints, search using:

      vdi_base_device: <Golden_Image_Device_ID>

3. Investigate Missing Devices:
   1. Search the CBC console's Audit Logs using the device ID or name of the missing golden image or "internal template".
4. Address Automated Deletion (if applicable):
   1. If the “internal template” is getting auto deleted, reference Horizon instant clone Internal templates are auto deregistered and eventually deleted.

Additional Information

• For the 'golden_device_id' field, the 'internal template' and the instant clones will have the device ID of the golden image.
• An “internal template” (that follows this naming format: `ITXXXXXX`)