Moving a TDR Host Sensor from one account to another

dcolpittsdcolpitts
in TDR - General Questions

I have two WG customers that merged to form a new company at the beginning of the year. We have merged their networks, and I've merged all the WG assets into one account. Now I am looking to move all the existing host sensors into the single account. Does anyone know any way to run a CLI to do this, or am I going to need to uninstall exact host sensor and then reinstall with the new account info?

dcc

Comments

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @dcolpitts

    You'll need to uninstall/reinstall. I'd suggest using AD helper to do this, it'll help automate the task.

    -James Carson
    WatchGuard Customer Support

  • dcolpittsdcolpitts

    No - found it via Strings.exe (from the Sysinternals Suite)... Just dropped the output of "strings host_sensor.exe" to a text file and searched for clearSensorUUID (which is used when imaging machines), and from that found setAccountUUID. Know this exists, then did a Google on setAccountUUID and found this:

    https://community.watchguard.com/watchguard-community/discussion/1393/account-changed-tdr-host-sensor

    From there is was just matter of putting it all together.

    net stop /y TDRSensorService64
    "c:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\host_sensor.exe" /setAccountUUID=new_account_uuid
    net start TDRSensorService64

    Now I'll scheduled a task with the Panda Management Agent on all machines

    dcc

  • xxupxxup

    This needs to be in the Knowledge base as a supported procedure..

    Adrian from Australia

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @dcolpitts
    This is not a supported procedure, if anything goes wrong, I would suggest the uninstall/reinstall procedure.

    -James Carson
    WatchGuard Customer Support

  • dcolpittsdcolpitts

    I also don't see how this would be any different than steps in the documentation for deploying TDR in OS Image, the only difference here is the account is also being changed in addition to the UUID.

    Anyways - it may not be supported, but it still worked like a charm, and no after effects yet 3 weeks later.

    dcc

Sign In to comment.