Isolation Issue Not IN Sync

dotran — Fri, 24 May 2024 15:27:12 GMT

Summary: Issue where devices are going into automatic isolation or coming out of isolation are not in the state that the Dashboard/portal thinks it is in. Cisco TAC ndicated there is a bug case CSCwj36632 but is not public. I'm making this public so that people are aware and how to fix it. Our Outbreak Control policy will only automatically Isolate 10 devices. If it wasn't for this safe guard, we would have to manually unisolate several hundred devices. However, this also weaken this feature if we limit the number of devices.

Sample Scenario:

Device gets issue an automated isolation command due to retrospective quarantine based on policy.
Looking at the Dashboard->Computer Management, device status is Not Isolated. Further, the button to Stop Isolation is not present, only the Start Isolation button is available.
However, the User reports their device is in Isolation.
Looking at the device Event log, we see where it tried to do an Isolation. Then we see a 'Failed to start Isolation' with an error of 'Duplicate job ID is received or overlapping start request'.
To get this device out of isolation, we needed to issue a Start then Stop Isolation commands. Sometimes, it can take several start/stop commands.

Re: Isolation Issue Not IN Sync

TomSmith — Tue, 28 May 2024 18:17:05 GMT

This was helpful. I had to click Start Isolation, then Stop Isolation immediately afterwards 3-4 times before it worked.

Re: Isolation Issue Not IN Sync

Chris05 — Fri, 14 Jun 2024 15:00:23 GMT

Thank you for this information. We recently had this happen and had to get a technician onsite to unisolate the laptop manually. If it happens again, I'll try start/stopping from the console a few more times.

topic Re: Isolation Issue Not IN Sync in Endpoint Security

Isolation Issue Not IN Sync

Re: Isolation Issue Not IN Sync

Re: Isolation Issue Not IN Sync