2016-11-07
03:03 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
duplicate machine on ECAT console
Hi, I noticed that there are duplicate entries for the same machine appear on the ECAT console. On the ECAT console, the machine with latest installed date were found online while the other one with earlier installed date is offline. ECAT agent on the affected machines are installed manually using the msi file. Any ideas why is that happened?
- Tags:
- Community Thread
- Discussion
- ECAT
- ECAT Agent
- ecat troubleshooting
- EDR
- Endpoint
- Forum Thread
- NetWitness
- NetWitness Endpoint
- NWE
- RSA NetWitness Endpoint
- RSA NetWitness Platform
- rsa_ecat
1 Reply
2016-11-07
10:49 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
suspect below key was removed during uninstall:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\ECAT]
[HKEY_LOCAL_MACHINE\SOFTWARE\ECAT\Temp]
"ServiceUid"=hex:fb,99,07,82,1d,dd,eb,47,ab,cb,c9,a4,97,88,85,dd
[HKEY_LOCAL_MACHINE\SOFTWARE\ECAT\Temp\ZI]
"034a145e"=hex(b):ee,c6,e7,aa,05,2a,91,27
Check with customer on this...
