Duplicate macOS Agents in Console
book
Article ID: 374063
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Show More
Show Less
Issue/Introduction
After a network change (ex: VPN) and a reboot, the macOS Agent is duplicated in the Console.
Environment
App Control Agent: All Supported Versions
App Control Server: All Supported Versions
Apple macOS: All Supported Versions
Cause
Apple macOS machines have three different types of hostname:
Computer Name: User-friendly hostname for the system (as seen in Finder), example: L1234
Local Hostname: The local (Bonjour) hostname, example: L1234.local
Primary Hostname: The fully qualified hostname (ComputerName + LocalHostName), example: L1234.domain.com
If the endpoint is configured to use a Dynamic Global Hostname a change in network connection could also alter the Primary Hostname and/or the Local Hostname of the machine.
Depending on the combination of changes, at the same time, this could trigger the Agent to re-register and show as a duplicate.
Resolution
Configure the macOS to use the same hostname regardless of network connection:
Verify Dynamic Global Hostname has been disabled on the endpoint(s).
Use Terminal to issue the following command to verify the Computer Name and Primary Hostname:
sudo scutil --get ComputerName sudo scutil --get HostName
Use Terminal to manually set the Primary Hostname to match the Computer Name
sudo scutil --set HostName <new hostname>
Flush the DNS cache:
sudo dscacheutil -flushcache
Restart the endpoint.
Additional Information
Typically this issue is more common on Intel based macOS machines when the Computer Name has not been set.
The Agent relies on system APIs to determine the hostname.
Engineering investigated this issue (EA-22001) and found no changes available in the Agent to circumvent this situation.
Feedback
thumb_up
Yes
thumb_down
No