The Trellix Agent uses a Globally Unique Identifier (GUID) to identify each managed system. Duplicating a virtual machine base image with a pre-existing GUID causes multiple systems to report as a single entity. To prevent this, you must remove the GUID from the virtual machine base image before finalization.
For persistent virtual images
A persistent virtual image is a reference virtual machine image used to deploy virtual machines that retain their system state, configuration, and identity across reboots or user sessions. On a persistent virtual image, manually clear the existing agent GUID.
Open a command prompt on the virtual machine base image.
Run the command that corresponds to your Trellix Agent version to enforce a noguid status:
Run the following command for agent versions below 5.8.1.
maconfig -enforce -noguid
For agent versions 5.8.1 and above.
maconfigCmd -enforce -noguid
For non-persistent virtual images
A non-persistent virtual image is a reference virtual machine image used to deploy virtual machines that do not retain system state or identity across reboots or user sessions.
For non-persistent Virtual Desktop Infrastructure (VDI) environments, install the Trellix Agent using VDI mode. In this mode, the Trellix Agent automatically deprovisions the virtual machine instance at shutdown. This process allows the ePO server to save the final properties of the deprovisioned agent before the agent is removed from the console.
You can install the Trellix Agent in VDI mode on Windows operating systems using one of the following methods:
For more information, see the Trellix Knowledge Base article, Trellix Agent deployment flow to VDI-mode systems - KB88533.