Resolving cloning questions

A question is displayed if the ESMC Server detects one of the following:

a cloned device connecting

a change of hardware in an existing device with ESET Management Agent installed

 
Every time a machine connects to the ESMC Server, an entry is created from its hardware fingerprint. This fingerprint is not changed after the machine is re-installed, so it can be used to match a newly connected machine to a previously connected machine.

validation-status-icon-warning IMPORTANT

Hardware fingerprint detection is not supported on:

Linux, macOS, Android, iOS

systems managed via ESET Virtual Agent Hosts (ESET Virtualization Security)

machines without ESET Management Agent 7

Click the question and select Resolve question to open a menu with the following options:

New computers are being cloned or imaged from this computer

Match with the existing computer every time

Select this option when:

You use the computer as a master and all its images should connect to the existing computer entry in ESMC.

You use the computer as a master to set up a VDI environment and the computer is in VDI pool and is expected to recover its identity based on a hardware fingerprint ID.

KB article

Create a new computer every time

Select this option when you use this computer as a master image and you want ESMC to automatically recognize all clones of this computer as new computers. Do not use with VDI environments.

KB article

Create a new computer this time only

Computer is cloned only once. Select to create a new instance for the cloned device.

KB article

 

No computers are cloned from this computer, but its hardware has changed

Accept changed hardware every time

Disable the hardware detection permanently for this device. Use only if non-existent hardware changes are reported.

This action is irreversible!

Accept changed hardware only this time

Select to renew the hardware fingerprint of the device. Use this option after the hardware of the client computer is changed. Future hardware modifications will be reported again.

Click Resolve to submit the selected option.

 

question

Double Agent situation

If an ESET Management Agent is uninstalled (but computer is not removed from Web Console) on the client machine and installed again, there are two same computers in the Web Console. One is connecting to the Server and the other one is not. This situation is not handled by the Questions dialog window. Such a situation is the result of incorrect agent removal procedure. The only solution is to manually delete_default remove the not connecting computer from the Web Console. The history and logs created before the re-installation will be lost afterward.

Using the Delete not connecting computers task

If you have a VDI pool of computers and you did not resolve the question (see above) correctly, the Web console creates a new computer instance after reloading of the computer from the pool. Computer instances stack up in the Web Console and licenses can get overused. We do not recommend to solve it by setting up a task for deleting not connecting computers. Such a procedure removes the history (logs) for deleted computers and licenses can also be overused.

Overused licenses

When a client computer with installed ESET Management Agent and activated ESET security product gets cloned, each cloned machine can claim another license seat. This process may overuse your license soon. The issue does not appear for all environments. If you experience the overuse, contact your reseller for a license modification.

Notifications for cloned computers

There are three prepared notifications user can use for cloning-related actions, change of hardware or user can create a new custom notification using cloning-related events. To set up a notification navigate to wakeup_default Notifications menu in the Web Console.

New Computer Enrolled – Notify if a computer is connected for the first time to the selected static group (the group All is selected by default). This works with ESET Management Agents 7 only.

Computer Identity Recovered – Notify if a computer was identified based on its hardware. The computer was cloned from a Master machine or other known source.

Potential Computer Cloning Detected – Notify about a significant hardware modification or cloning if the source machine was not flagged as a Master before.