Endpoints appearing as a single endpoint

Issue

When viewing an endpoint in the console, information for multiple endpoints is being reported under a single endpoint instance.

Environment

This can affect both Windows workstations and servers.

Symptoms

• Affected endpoints usually will not show up when searching the endpoint table, since only the most recent endpoint sharing the instance will be displayed in the table
• When viewing an endpoint, events from multiple endpoints will be listed

Cause

When the endpoint agent is installed, a machine_id is calculated using variables on the endpoints such as the Windows GUID. The endpoint will also receive a nebula_machine_id when it first registers to the console. 

This issue will usually manifest in one of two ways:

• Endpoints cloned without the use of sysprep, causing each cloned endpoint to generate the same machine_id and be assigned the same nebula_machine_id
• A base image with an installation of the ThreatDown Endpoint Agent registered with the console and received a nebula_machine_id before generalization occurred. All endpoints deployed with this image will then have the same nebula_machine_id

You can check both the machine_id and nebula_machine_id by running this command on the endpoint:

"C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\eacmd.exe" -getmachineids

If endpoints share the same nebula_machine_id value, they are affected by this issue

Resolution

We recommend the use of Sysprep to prepare the base image without letting it connect to the internet. You can find steps to do this in this document: Prepare an image in Sysprep for endpoint agent

If deployment has already occurred and endpoints are in this state, the following command can be used to force the generation of a new machine_id and nebula_machine_id:

"C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\eacmd.exe" -GenerateNewMachineId

Important to note:

• This command is only available on endpoint agent version 2.5.0.60 and above
• This command will usually take about 5 minutes to complete
• It is expected behavior for this command to throw an error when complete as it restarts the endpoint agent service as part of it's process
• This command will need to be ran on all machines with the duplicate nebula_machine_id

You can verify the command was successful by running the -getmachineids command again. If the ID's haven't changed, contact ThreatDown support for assistance:

Contact ThreatDown Support for Nebula

Contact ThreatDown Support for OneView