Can you recover an ATP or SEDR VM after you have expanded Hard Disk 1?
Article ID: 171260
Updated On:
Products
Issue/Introduction
When preparing the SEDR VM for using Endpoint Activity Recorder, Hard Disk 1 was expanded to 1,500 GB in an attempt to meet the required specifications.
Cause
The steps for extending the Appliance storage calls for an extra hard drive to be added before running the 'extend_storage' command.
Resolution
There is no way to recover the space incorrectly allocated to Hard Disk 1. The SEDR software cannot be guaranteed to function correctly if Hard Disk 1 gets modified. Since this is an unsupportable condition, the VM will need to be redeployed and a Hard Disk 2 with a size of between 1 and 2TB be added for the Endpoint Activity Recorder on the new SEDR VM.
Please refer to the Virtual Appliance installation workflow for the correct deployment steps: https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-detection-and-response/4-7/about-v96380626-d38e6/virtual-appliance-installation-workflow-v133549683-d38e6790.html
Feedback
