Endpoint Protection

Hello!

Some weird things just started with my SEP/SEPM about 3 weeks ago.
First, I noticed that a new install package appeared.  This new package is 11.0.5002.0.  It was created on 10/23/2009.  My SEPM version is 11.0.4202.75 so I don't know how it got there.

Second, new clients are not showing up in the SEPM console.  I when going to the client there's a green light and everything appears to be working.  When I open the client up and go to Help and Support and select troubleshooting I show my SEPM server listed as the server.  But on machines that are not in the SEPM console the Location is different.  On working clients, the Location is set as "Default" where the ones that are not appearing show the location as "Corporate Network".

I also can't search for the clients in the SEPM.  They don't appear anywhere even thought the troubleshooting shows my folder topology.

Any thoughts/suggestions because I'm stumped!!

Thanks in advance!
CJS

 1. The New Package is downloaded via Liveupdate-Client Update
2.Right Click and Go to properties of the groups and check if you have Block New Clients checked ?
3, On the Client when u go to Help and Support-Troubleshooting--what does show for Group?

Vikram-

Thanks for the reply.  Its good to know that I wasn't going insane when I saw that package then. 

As for the Group, it shows My Company\Wisconsin\Workstations

But when i search that group I can't find it anywhere.  Also I just noticed the following:

My two workstation groups
My Company\Wisconsin\Workstations
My Company\Iowa\Workstations

Have two location-specific policies and settings but our Workstation team insists that they didn't create anything.

The first location is "Corporate Netowrk" and the second is "Untrusted Network"

Only the Workstation groups have those locations.  The groups with our servers have the default location "Default"

CJS

I dont have the Block new clients flagged.

I also noticed that when I deploy new clients, no matter where I put them in the "push" they go into the above noted group.  But I can't find any of them in the group.  Is there a limit on the number of objects in a group?

CJS

Whether the groups which you are seeing in the clients  are present in your SEPM?
If present check whether the clients are appearing in that group..
If it is not present give update policy in the clients and see whether it is appearing in that group in console?
For these groups ensure that you are not selected block clients option (This may be inherited one from parent group also).

Do you have any other domain configured under Admin-->Domains.

You can search the client in the SEPM DATABASE. This is a long process but you will find out whether the client is present in the database.

Get the ComputerID and HardwareID under following key...
HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink

  Use this SQL to get the details of the client in the MS Database
___________________________________________________________________
SELECT [CLIENT_ID]
,[DOMAIN_ID]
,[GROUP_ID]
,[POLICY_MODE]
,[COMPUTER_ID]
,[HARDWARE_KEY]
FROM [sem5].[dbo].[SEM_CLIENT] where [HARDWARE_KEY] = 'put HardwareID from
above reg key'
___________________________________________________________________


Then get Group name using this SQL.

SELECT [ID]
,[NAME]
,[TYPE]
,[DOMAIN_ID]
FROM [sem5].[dbo].[IDENTITY_MAP] where [ID] = 'GROUP_ID from above SQL'

Now you will be able to see to which group the client are pointing to 
___________________________________________________________________

REF:
https://www-secure.symantec.com/connect/forums/clients-showing-offline-even-after-reinstall#comment-3089981
 

Ok so I verified that no folders had the "Block New" flagged.  We only have a single domain in our AD and I ran the SQL queries.  The output shows:

Ok,
It appears that all "new" clients are being forced into that group.  This is done reguardless of how the deployment is configured.  Once deployed, they appear in SQL and are receiving updates but are not visible in the console at all.

CJS

seems like it has multiple entries you can check this discussion to clear out the duplicates.

 https://www-secure.symantec.com/connect/forums/duplicate-ad-imported-clients-ru5

There are no duplcates in the Database.  In the DB I only show 1 HardwareID per computer.

How many domains are present in your SEPM ?.(This domain is different from AD Domain).You can check it in Admin--->Domains
If multiple domains are available login to that domain and check client is present or not..
Are you imported OU to SEPM or you created all groups manually?
If it is imported from OU do a re synchronization with your DC
 

Try this...

Get the Group ID of known group from  [sem5].[dbo].[IDENTITY_MAP] table.
use this sql to update the client which is not appearing in the console to point to the known group ID.

UPDATE [sem5].[dbo].[SEM_CLIENT]
SET [GROUP_ID] = 'New group ID'
  WHERE [CLIENT_ID] = 'Mising Pc CLIENT_ID'

Now the client will show under the group you have specified.

Try this script and see whether your client move to proper group....

 http://www.symantec.com/connect/downloads/tool-move-clients-groups-based-ip-addresssepm

Hea try below,

stop start SMC and check clients moving from one group to other rendomly if yes revert me i have solution....