Moving a TDR Host Sensor from one account to another
I have two WG customers that merged to form a new company at the beginning of the year. We have merged their networks, and I've merged all the WG assets into one account. Now I am looking to move all the existing host sensors into the single account. Does anyone know any way to run a CLI to do this, or am I going to need to uninstall exact host sensor and then reinstall with the new account info?
dcc
0
Sign In to comment.
Comments
Hi @dcolpitts
You'll need to uninstall/reinstall. I'd suggest using AD helper to do this, it'll help automate the task.
-James Carson
WatchGuard Customer Support
No - found it via Strings.exe (from the Sysinternals Suite)... Just dropped the output of "strings host_sensor.exe" to a text file and searched for clearSensorUUID (which is used when imaging machines), and from that found setAccountUUID. Know this exists, then did a Google on setAccountUUID and found this:
https://community.watchguard.com/watchguard-community/discussion/1393/account-changed-tdr-host-sensor
From there is was just matter of putting it all together.
net stop /y TDRSensorService64
"c:\Program Files (x86)\WatchGuard\Threat Detection and Response\amd64\host_sensor.exe" /setAccountUUID=new_account_uuid
net start TDRSensorService64
Now I'll scheduled a task with the Panda Management Agent on all machines
dcc
This needs to be in the Knowledge base as a supported procedure..
Adrian from Australia
Hi @dcolpitts
This is not a supported procedure, if anything goes wrong, I would suggest the uninstall/reinstall procedure.
-James Carson
WatchGuard Customer Support
I also don't see how this would be any different than steps in the documentation for deploying TDR in OS Image, the only difference here is the account is also being changed in addition to the UUID.
Anyways - it may not be supported, but it still worked like a charm, and no after effects yet 3 weeks later.
dcc