Endpoint Protection

I have a very strange problem I hope someone can assist.

I am running SEP 11 RU6 MP2

I have two clients A and B.  Client A is included in the group WITH USB access while client B is included in NO USB access group as configured in the Device Control.  I received a call from client A that his PC can not access the USB.  I searched for Client A in the group with USB access but I can not find it there.  I was able to locate Client A from the group without USB access.

So I moved back Client A to group with USB access and this is where the funny thing happened. Client A became Client B for a few minutes.  Then suddenly upon refresh of SEPM, Client B became Client A.  At this instant, I can not also find Client B in the group with no USB access.

I tried to move Client A in the Default Group and after few minutes, Client A is gone but Client B suddenly appeared in the Default group.

I have already uninstalled and reinstalled SEP for both clients but the situation is still the same.

Right now, I put Client A in the group with USB access but Client B is also getting the same access to USB when it should not.

Any suggestion please?

Hi,

You click the "Use the client's last-used Group setting" from reconnection preference.

To enable to do that follow the URL

http://www.symantec.com/business/support/index?page=content&id=TECH132001&locale=en_US

Thanks Pete... I missed to click "Use the client's last-used Group setting" for Client A's group so I did it.  All other groups including Client B's group already clicked beforehand.

However, I still can not see Client B when Client A is in its group.

I tried to run Find Unmanaged Computers and found Client B.  I deployed the SEP package and made it to appear in Default Group but Client B again appeared in Client A's group and this time replacing Client A.

So I am still back to square 1.

are these machine installed using an image?

if yes, check the URL

http://www.symantec.com/business/support/index?page=content&id=TECH96808&locale=en_US

Thanks Pete.  I did not know that they used image for PC B and your suggestion saved the day upon clearing previous hardware ID.

By the way, do you forsee any relation of this problem to a Database Down notification I have been receiving ever since we had this problem?

The reason why I asked is right after resolving this,  I received this Database Down notification.

can you post the error?

Hi Pete,

Error Mesage Below:

Message from:

               Server name: xxxxx

               Server IP: xxx.xx.xx.xx 

The Symantec Endpoint Protection Manager database has gone down and needs immediate attention.

does the error showed above matches the time from event viewer?

I have also read on forum about these errors, which sometimes are false positive.

Event viewer shows no database related error.  There is even no log entry for the time shown.

I would like to believe regarding the possibility of false positive but in occassions where I am logged in SEPM and I receive the email notification of Database Down, I get logged off with info "Administrator not found [ 0 x 11010000]".

What do you think?

looking into scm-server-0.log during this occurence will help to understand the reason for the error.

if the DB srevice is down, you get the unexpected server error.

2011-02-25 15:29:08.429 SEVERE: Unknown Exception
org.apache.commons.dbcp.SQLNestedException: Cannot get a connection, pool error Timeout waiting for idle object

2011-02-25 15:29:08.429 SEVERE: Unexpected server error.
com.sygate.scm.server.metadata.MetadataException:

these are the two messages.. from the above it looks like SEPM is under high high utilization becuase of the SQL performing the activity at this time.

Do database maintainence activity on SQL as well finetune the SEPM (like incrase the heartbeat of the clients, reduce teh number of activity logs retention)

Thanks Pete... I will certainly perform what you suggested in order to lessen database activity.

Question:  Does increasing client heartbeat decrease high utilization of SEP?

Because "at each heartbeat, the server takes the following actions:

Question:  Does increasing client heartbeat decrease high utilization of SEP?

yes the SEPM performance betters when compared to Push mode. The reason you stated are true as becuase of less frequent of update of logs and connection with SEPM.

Thanks Pete.  I am able to check the log at scm-server-1.  Appreciate if you can assist to spot what is odd about the logs as attached.

The exact time of the latest "Database Down" email notification is Fri 2/25/2011 15:29 PM

Thanks for your patience.