WHOA - hold the phone here!  Hmmmm - I just did the EXACT same thing a couple hours ago - and those computer never check in!
Their LU button is grayed out, but no green light and the defs are old. Like they got PARTIAL settings!
AHA - it's not just me..

In fact, I could have written that very message myself, word-for-word!! Every detail is the same, including not wanting to RDP and knock them off!
Does that sort of push NOT put the SYLINK file in there, or whateverit's called?

I have seen this with both methods of deployment (Push Migration Wizard) and the Find Unmanaged Computers. I figured I had hosed a machine here and there and I wasnt too concerned. But I have seen too many not check in to not start asking if others are seeing the same thing. If the answer is in the logs, then thats ok and I will start trying to look at the logs, but as I mentioned I cant kick users off. I wish that you could redirect the log files to a share.

I had been looking for someone else with this problem as well. I was doing installs after hours and noticed many of the PCs were not showing up in the SEPM. The strange part is, the clients have the green dot, and are getting their definitions, etc.

Try going to Monitors > Logs in the SEPM console, and search by the computer name. I was able to find logs for these "missing" clients.

Just today I found all the clients hiding in a group of 800 computers they don't belong with...running in "User Mode." After manually changing them back to "Computer Mode," they are now showing up when I search the clients tab.

You are right on! Thats exactly what was happening ( at least so far). One question for you though. How can did you tell that it was in user mode and not computer mode other than looking on the actual client? Wouldnt the computer mode policy update that client from user mode to computer mode ?

Thanks,
Alan

One can use
Start->Run->compmgmt.msc->Right click on "Computer Management (Local)"->Connect to another computer->Type in name of other computer, Ok->System Tools->Event Viewer->Application (and System)

Given enough rights one can see there events of successfull or unsuccessful installation like:

Event Type:    Error
Event Source:    MsiInstaller
Event Category:    None
Event ID:    10005
Date:        XX.XX.20XX
Time:        16:00:56
User:        XXXXXXXX
Computer:    XXXXXXXXXXX
Description:
Product: Symantec Endpoint Protection -- Symantec Endpoint Protection has detected that there are pending system changes that require a reboot.  Please reboot the system and rerun the installation.

umass: If you have the SEP Manager, you can look in the clients tab, and the icon that is displayed on the left side of the "Name" column indicates what mode that client is in.

I just happened to check one of my test clients and saw that it was in a group it didn't belong in. When I went and looked through that group...there were all my missing clients buried at the bottom. Keep in mind that when they are in user mode, the left "Name" column actually displays the username, and the PC name ends up in the "Logon Client" column (for some rediculous reason).

To sweeten the whole deal, I had to change each one back to computer mode one at a time. If you select multiple and right-click, you'll see the option to "Switch to Computer Mode" is greyed out...weak.

I guess the question becomes, why all of a sudden are my new installs defaulting to settings I'm not choosing?

We are seeing the exact thing on our servers. PCs are going into groups they dont belong to and some are in User mode.
Symantec gave us a command line java tool to script the movement based on IP ranges but its still a pain to do this repeatedly with 30k users deployed.
The users moving around randomly was supposedly fixed in MR4, but they just stopped going into one group and now go into another.
What makes this worse is that we have several servers across the country and SEP Clients have started migrating across states. They seem to ignore their MSL setting.

Anyone from Symantec have any insight?

I just found this post...

https://www-secure.symantec.com/connect/forums/push-install-computer-mode-actually-puts-it-user-mode#comment-2229521

Sounds like the same issue, and suggests a possible cause. Hopefully we'll get some kind of response from Symantec on the issue.

Thanks fmav_admin.

I just read that also. I am not sure that is the case with me. I have seen two different scenarios so far.

Client push using domain admin account (never installed anything on these clients), shows successful, but client never appears.

Client push using domain admin account (never installed anything on these clients) and client appears in another group, but remains in Computer mode.

There are also other variables such as the version of SAV that I am upgrading them from, changing clients from unmanaged to managed SEP clients, OS version and a few others.

I only saw two instances of the computer checking in set in user mode.

I am also having same problem.

We are having around 30000 client and diff to move or change..

Any fix avail..............?

I'm also having the same issue, anyone get any fixes or logs to check?

Cheers

Matt

create a case with symantec and get the move clients script form them.

U can move the clients based on ip address range and change the user mode to computer mode.

once u change and move all the clients u will not find any usermode clients.
 

If you guys want to use a Utility for the above purpose, here are few things those you can check for

-- Create new Group and then Create a new Pckage for this Group in Computer Mode(Make sure this is a Non Single Exe Package)

-- From this package pick the Sylink.xml file and use the following utlity to push this file to the computers(Try this on few computers first)

The Sylinkreplacer tool for connecting SEP clients to a SEPM
Link: https://www-secure.symantec.com/connect/downloads/...