Resolving cloning questions

A question is displayed if the ECA Server detects one of the following:

a cloned device connecting

a change of hardware in an existing device with ESET Management Agent installed

Every time a machine connects to the ECA Server, an entry is created from its hardware fingerprint. This fingerprint is not changed after the machine is re-installed, so it can be used to match a newly connected machine to a previously connected machine.



Hardware fingerprint detection is not supported on:

macOS, Linux

machines without ESET Management Agent 7

Click the question and select Resolve question to open a menu with the following options:

New computers are being cloned or imaged from this computer

Match with the existing computer every time

Select this option when:

You use the computer as a master and all its images should connect to the existing computer entry in ECA.

You use the computer as a master to set up a VDI environment and the computer is in VDI pool and is expected to recover its identity based on a hardware fingerprint ID.

KB article

Create a new computer every time

Select this option when you use this computer as a master image and you want ECA to automatically recognize all clones of this computer as new computers. Do not use with VDI environments.

KB article

Create a new computer this time only

Computer is cloned only once. Select to create a new instance for the cloned device.

KB article


No computers are cloned from this computer, but its hardware has changed

Accept changed hardware every time

Disable the hardware detection permanently for this device. Use only if non-existent hardware changes are reported.

This action is irreversible!

Accept changed hardware only this time

Select to renew the hardware fingerprint of the device. Use this option after the hardware of the client computer is changed. Future hardware modifications will be reported again.

Click Resolve to submit the selected option.




Double Agent situation

If an ESET Management Agent is uninstalled (but computer is not removed from Web Console) on the client machine and installed again, there are two same computers in the Web Console. One is connecting to the Server and the other one is not. This situation is not handled by the Questions dialog window. Such a situation is the result of incorrect agent removal procedure. The only solution is to manually delete_default remove the not connecting computer from the Web Console. The history and logs created before the re-installation will be lost afterward.


Notifications for cloned computers

There are two prepared notifications user can use for cloning-related actions, change of hardware.

Computer Identity Recovered – Notify if a computer was identified based on its hardware. The computer was cloned from a Master machine or other known source.

Potential Computer Cloning Detected – Notify about a significant hardware modification or cloning if the source machine was not flagged as a Master before.