Duplicate Devices with the same name across multiple customers and sites

Last Modified

Wed Sep 09 15:20 GMT 2020

Description

• A device named michael-7-x64, VMScan-PC, ADMIN-PC or JOHN-PC is showing up as disconnected across different Customers or Sites.
• This is the result of a third party application which is using a virtual machine or sandbox. This sandboxing is common in AV products which perform behavioural testing by running suspicious software inside of a protected environment to observe its actions.
• So, the root cause could be:
  • AV/Threat Detection/other automation is Installing the N-able N-central Agent inside of a VM or Sandbox from which it is self registering.
  • A similar type of Virtual Machine being disovered by the N-able N-central Probe during Asset Discovery.
• Here are some examples of Applications which perform this type of sandboxing:
  • VirusTotal - uses a sandbox for malware analysis. https://en.wikipedia.org/wiki/VirusTotal
  • Kaspersky - uses a Sandbox mode for malware analysis. https://en.wikipedia.org/wiki/Kaspersky_Internet_Security

Environment

• N-able N-central

Solution

1. Browse the Import Discovered Assets list > checkmark these devices > click Ignore.
2. If the devices continue to appear in the Asset Import list, disable any recurring Asset Discovery jobs.
   • More information:
     • https://documentation.n-able.com/N-central/documentation/Content/Configuration/Discovery_Jobs/Assest_Discovery_Overview.htm

• Note: This issue should no longer occur on N-able N-central 2020.1 with the introduction of Registration Tokens.