Endpoint Protection

Dear All,

I have observer a strange problem in our setup.
When we started SEP deployment we created few group and deleted them(moved existing clients to other group's) after  some time according to customer requirement. (Clients installation continued for 100 pc's with the old package because of communication delay).

Clients which were pointing to those groups we showing as offline.
We reinstalled all(with different package pointing to diff group) clients but still it was showing offline.

Then I checked these clients GROUP_ID in the database it was pointing to the old groups GROUP_ID.

I used SQL query to change all the GROUP_ID's of clients which were point to nonexistent group to existing groups and came out off this problem.

I want to know the reason behind this behavior? Was it fixed in the newer releases?
(I am using SEP MR4)

Did you tried  repalcing the Sylink on these clients ??

Hi

You may try to replace the sylink.xml of the appropriate group and check if it works.

You may use the Sylink replacer which you can find at the below link

https://www-secure.symantec.com/connect/downloads/sylinkreplacer-tool-connecting-sep-clients-sepm


If still does not work you have to delete the sylink.bak file from the client system and then replace sylink.xml

Replacing the Sylink will fix this problem.

Copy the sylink file from the SEPM machine,Location is C:\Program Files\Symantec\Symantec Endpoint Protection Manager\Data\Outbox\Agent\
Here u will find several AlphaNumeric groups just open any of the goup and copy the sylink.

Go to the SEP clien machine and paste this file to C:\Program Files\Symantec\Symantec Endpoint Protection.

U might get an error while pasting the sylink, then stop the services and retry to paste it.

This will be a manuall procedure, use the sylink replacer.exe to centrally replace the sylink file.

Ajit

Hi,

If its getting offline, try belkow steps.

1) From your sep manager console, try to move offline clients to correct group.
2) try to push update content and scan command from your sep manager console.

Please revert if it works....

you need to delete the clients from the SEPM, delete the group from SEPM console.

then try installing client withthe latest package.Use the package  which has .msi file and ensure if the sylink.xml file has preferred group entry.

good luck
Pete

Export the communication setting from your group then replace the existing sylink.xml to new sylink.xml hope it works

After replacing the sylink file once it contact the server it again go to offline changed its group and status offline.

below mentioned registry key shows proper group but in GUI it shows old group.

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink
"PreferredGroup"="My Company\\ALL-SERVERS"
 

I tried to put new sylink file...

Once it connect to server, sylink file will be replaced with new one and show's old group.

This problem started after deleting group's and clients....

We created new groups and started installing clients with newly exported package...
Still we had the same issue...
 

Hi guys.. i dint get any solution and did a work around...

I got the ComputerID and HardwareID under following key...
 HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink
 
  I used this SQL to get the details in the MS Database
 ___________________________________________________________________
 SELECT [CLIENT_ID]
 ,[DOMAIN_ID]
 ,[GROUP_ID]
 ,[POLICY_MODE]
 ,[COMPUTER_ID]
 ,[HARDWARE_KEY]
   FROM [sem5].[dbo].[SEM_CLIENT] where [HARDWARE_KEY] = 'put HardwareID from above reg key'
 ___________________________________________________________________
 

Then i got the Group name using this SQL.

 SELECT [ID]
 ,[NAME]
 ,[TYPE]
 ,[DOMAIN_ID]
 FROM [sem5].[dbo].[IDENTITY_MAP] where [ID] = 'GROUP_ID from above SQL'
It was still pointing to old group id...
 ___________________________________________________________________
 
   
Then i changed the group id
 
 UPDATE [sem5].[dbo].[SEM_CLIENT]
SET [GROUP_ID] = 'New group ID'
WHERE [CLIENT_ID] = 'Pc CLIENT_ID' 
___________________________________________________________________

Now all clients started to come in the console and its showing online...


Thanks for all your suggestions...