Problem with domain polling

[Gabriel Boettcher]

Kaspersky Security Center - 15.1.0.20748

Windows Server 2016

Our main server manages around 12 virtual servers. During domain polling configurations, domains from other companies are automatically detected, coming from different virtual servers. Even after manual deletion, these domains continually reappear, generating operational problems, such as the wrong allocation of machines within the company. For example, the company Fama often detects domains belonging to the companies Precisa and Cerealista. This problem occurs on several virtual servers, making management very difficult.

[Diego Moraes]

Hello, what may be happening is that hosts are being detected in these domains, even if the OU is manually deleted, synchronization with Active Directory causes the KSC to recreate the OU to add the host to that location.
To resolve this, delete the host record from DNS and Active Directory.

Another check you can do is to see what the IP of this host is that was detected in this OU, go to search in the KSC and type in that IP. If there is more than one, this host probably changed its name, and that is the one you need to delete from AD.

[Renan Corassa]

Make the appropriate adjustments to the domain survey properties.

[Gabriel Boettcher]

On 11/01/2025 at 14:46, Renan Corassa disse:

Make the appropriate adjustments to the domain survey properties.

What kind of adjustments? The domain polling settings are only related to configuring how often the quick and full polls are performed, as far as i know.

[Gabriel Boettcher]

On 10/01/2025 at 08:16, Diego Moraes disse:

Hello, what may be happening is that hosts are being detected in these domains, even if the OU is manually deleted, synchronization with Active Directory causes the KSC to recreate the OU to add the host to that location.
To resolve this, delete the host record from DNS and Active Directory.

Another check you can do is to see what the IP of this host is that was detected in this OU, go to search in the KSC and type in that IP. If there is more than one, this host probably changed its name, and that is the one you need to delete from AD.

Yes, but the AD polling is also disabled. I shouldn't be having this problem

[Tahmeed702]

Stop All polling like Domain polling , IP Polling and AD Polling , if they are polled where these servers are assigned is it in unassigned section ...??

 

[Gabriel Boettcher]

6 minutes ago, Tahmeed702 disse:

Stop All polling like Domain polling , IP Polling and AD Polling , if they are polled where these servers are assigned is it in unassigned section ...??

 

I didn't understand very well. yes this devices inside this domains are within the unassigned section

[Tahmeed702]

1 minute ago, Gabriel Boettcher said:

I didn't understand very well. yes this devices inside this domains are within the unassigned section

Check Device Discovery Section of KSC and Stop All polling like Domain polling , IP Polling and AD Polling , and send a Screenshot of Unassigned section.

[Gabriel Boettcher]

7 minutes ago, Tahmeed702 disse:

Check Device Discovery Section of KSC and Stop All polling like Domain polling , IP Polling and AD Polling , and send a Screenshot of Unassigned section.

The devices from other companies are still showing up even after I stop all options of polling, in the virtual server and in the primary server

[Tahmeed702]

4 minutes ago, Gabriel Boettcher said:

The devices from other companies are still showing up even after I stop all options of polling, in the virtual server and in the primary server

Now Delete all devices from Unassigned Sections , and wait if devices got increased, are you using Master Slave architecture

[Gabriel Boettcher]

8 minutes ago, Tahmeed702 disse:

Now Delete all devices from Unassigned Sections , and wait if devices got increased, are you using Master Slave architecture

We have one primary server with several virtual servers inside it, but each virtual server has it's own task and policies. I don't know if that fits as Master Slave architecture.