Article Number
000001407
Applies To
RSA Product Set: NetWitness Endpoint formerly ECAT
RSA Product/Service Type: NetWitness Endpoint formerly ECAT
RSA Version/Condition: 4.x
Platform: Windows
Product Description: RSA NetWitness Endpoint formerly ECAT
Issue
A cloned virtual machines don't appear in the ECATUI, or only one cloned machine appears online in the ECATUI at any given time.
Cause
The Virtual Desktop Infrastructure (VDI) refers to the process of running a user desktop inside a virtual machine (VM) that lives on a server in the datacenter.
A number of different companies provide the software for this VDI environment like: VMware ESX; Citrix Provisioning Service (PVS); Microsoft System Center Virtual Machine.
The automatic deployment of VMs generally requires a pre-built Gold image of the machine to use during deployment as Clones. The Gold image will include the ECAT Agent software already installed.
The problem arises when a Clone (or multiple Clones) is created from the Gold image. The unique AgentID in the Gold image is copied to the Clone, and as a result, it is no longer unique in the Clone's communication to the ECAT Server. So the ECATUI can only show one Clone system as online at a time.
Resolution
The Clone machine's startup script can run a Powershell script to uniquely set a unique ECAT AgentID value.
This assumes the hostname of the Cloned system changes on startup, and the hostname is from a known pool of hostnames.
1. Perform the following steps to install and configure the ECAT Agent software on the VDI Gold image machine.
a. Install the latest ECAT Agent software version onto the Gold image VM.
b. Allow time for the ECAT Agent to execute all scheduled tasks (which should include at least the initial quick scan after the ECAT Agent software is installed).
c. Change the ECAT Agent service from ‘Automatic’ to ‘Automatic (Delayed Start)’ in the Gold image VM.
