Endpoint Protection

Good afternoon all, 

We have several regional SEPM (12.1 on Windows 2003 32bit) which are replicated (one way) to a central SEPM.  The regional SEPM will accurately display the client and product status, however, the central SEPM shows the clients as offline with no client information.  I've made a few changes (as seen below) and hav left the system for 12 hours to see if these change would positively impact the environment, but unfortunately I've seen no change.

The regional sites are currently set to replicate once a day, so I would not expected to see a realtime status of the client on the central SEPM, however, I would expect to see an accurate representation of the regional SEPM after I've performed a manual replication.

I've taken the following steps to troubleshoot the issue:

1. Changed heartbeat to pull with an interval of 60 minutes.

2. Confirmed that replications from the regional to central SEPM is working properly by manually initiating a replication

3. Confirmed that regional client settings are being replicated to a central console by setting a client as a unmanaged detector on a regional SEPM and then replicating and confirming that this setting is reflected on the central SEPM. 

4. Confirmed that policy changes are replicated down to regional from the central by making policy changes on the central and confirming these are in place on the regional after a replication is forced. 

Your assistance would be greatly appreciated.

Thank you

094

Are these groups imported from AD? all the SEPMs in the replication are of same version?

Does it show back online if you manaully kick off a replication or has it always showed offline? You can confirm it has the green dot on the client?

Hello, Thank you for your response.

The groups are not imported for AD (I believe), and the SEPM's are the same version (12.1.1101.401 RU1, MP1).

I belive on replication it will have a red arrow indicating that its reporting to different sepm.

when you create a client online activity , is it the clients local to sepm are online and others offline ?

Do you have a screenshot of the SEPM showing the client offline?

@Brian81

The clients status is accurately indicted on the regional SEPM, however, when I kick off a manual replication, the status of the client on the central SEPM does not change (Stays Offline).

@Rafeeq

The clients appear "offline" on the central SEPM, and the "Client Version" appears as "Client version unavailable"

@Brian81

I've attached two screencaptures, "Central SEPM" and "Regional SEPM".

You can see that the status of the clients are accurately displayed on the Regional SEPM however, on the Central SEPM they are shown as offline.  Also, I've selected one of the clients as a unmanaged detector. If I enabled/disable this functionality, the new status (enabled/disabled) is accurately reflected on the replication partner.  This tells me that the replication of client information is working to sime extent.

I'm continuing to experience this issue, I've tried restarting both the central and regional SEPM servers with no such luck.  I've also enabled two way replication and let the engine determine when to perform the replication instead of performing the replication at a regular interval.  

Any advice would be greatly appreciated. 

Thank you,

Todd