Endpoints being deregistered unexpectedly, audit log indicating "deregistered through auto de-registration of CWP workloads", but Workload is not enabled in org.

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• Linux/Windows sensors are being deregistered due to lack of checkin, audit log shows "auto de-registration of CWP workloads"
• Org does not have Workload entitlement

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows sensor: All Support versions
• Carbon Black Cloud Linux sensor: All Support versions

Cause

This issue has been identified as a product defect and is being tracked by our Engineering team as DSER-55121

Resolution

DSER-55121 will be addressed in a future update.  We recommend impacted Orgs disable "Deregister VDI sensors that have been inactive for" option in all locations for endpoints that are not VDI:

1)  Disable at global level, under Inventory>Endpoints>Sensor Options>Manage Sensor Settings in the Carbon Black Cloud Console with setting named "Deregister VDI sensors that have been inactive for"

2)  Disable at policy level, under Enforce>Policies>[Policy_Name]>Sensor where the setting is named "Auto-deregister VDI clone sensors after".  This should be done for all policies.

3) "Auto-deregister VDI clone sensors after" setting (per policy) should only be enabled/configured on Policies containing exclusively VDI sensors until DSER-55121 is addressed.