Duplicate macOS Agents in Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

After a network change (ex: VPN) and a reboot, the macOS Agent is duplicated in the Console.

Environment

• App Control Agent: All Supported Versions
• App Control Server: All Supported Versions
• Apple macOS: All Supported Versions

Cause

Apple macOS machines have three different types of hostname:

• Computer Name: User-friendly hostname for the system (as seen in Finder), example: L1234
• Local Hostname: The local (Bonjour) hostname, example: L1234.local
• Primary Hostname: The fully qualified hostname (ComputerName + LocalHostName), example: L1234.domain.com

If the endpoint is configured to use a Dynamic Global Hostname a change in network connection could also alter the Primary Hostname and/or the Local Hostname of the machine.

Depending on the combination of changes, at the same time, this could trigger the Agent to re-register and show as a duplicate.

Resolution

Configure the macOS to use the same hostname regardless of network connection:

1. Verify Dynamic Global Hostname has been disabled on the endpoint(s).
2. Use Terminal to issue the following command to verify the Computer Name and Primary Hostname:

   sudo scutil --get ComputerName
   sudo scutil --get HostName

3. Use Terminal to manually set the Primary Hostname to match the Computer Name

   sudo scutil --set HostName <new hostname>

   • If desired/necessary, the following command can be used to set the Computer Name:

     sudo scutil --set ComputerName <new hostname>

   • If desired/necessary, the following command can be used to set the Bonjour Hostname:

     sudo scutil --set LocalHostName <new hostname>

4. Flush the DNS cache:

   sudo dscacheutil -flushcache

5. Restart the endpoint.

Additional Information

• Typically this issue is more common on Intel based macOS machines when the Computer Name has not been set.
• The Agent relies on system APIs to determine the hostname.
• Engineering investigated this issue (EA-22001) and found no changes available in the Agent to circumvent this situation.