Endpoint Protection

Long story short, I was having an issue with machines that were reported with scan failures. As I've been going through the list, I've got an increasing number of machines with duplicate IP addresses. The serial number and GUID are unique but, they're not checking in I believe* because of that duplicated IP address.

The thing is, we image all our machines on two VLANS. They get their own version of SEP installed (not from the image) and we verify they check into the SEPM and get their defs before rolling them out. It's not all of our machines though, which is weird. Is it possibly an issue with the version 12.1.4 that's installed on these clients? I've been upgrading our machines to 12.1.6.1 and as these aren't checking in, they're not getting that update either.

You can try the repair quickly to see if it corrects it:

Repair duplicate IDs on cloned Endpoint Protection 12.1 clients

But make sure you follow the steps for imaging with 12.1 clients:

How to prepare a Symantec Endpoint Protection 12.1 client for cloning.

Not sure that applies to us. Each install is unique. SEP is not a part of the base image for this exact reason.

Blow away the ID and see if it shows up. Not sure I remember any issues going from 121.4 to 12.1.6 but I'll have to go back through fix notes.

Different clients reported with same IP addresses should not be an issue (with SEP, at least) in a network with dynamic IP address. It is possible that the same IP address is being reassigned to different client based on the availablity of the IP address and the status of the clients.

It is an issue only if clients that reported to the SEPM with the past 28 days disappeared from the SEPM today. (assuming that the no of days to delete not connected client is set to 30 days)

Seyad,

I believe you are on the correct path. We image all of our machines at the same location on the same VLAN even, so this could cause the duplicate addresses. However, when they reach their final location and connect to the network, they should be checking in and getting a new IP address.

I see that option under Admin>Domains>Default - but our machines are not being removed from SEPM after 30 days of inactivity.

There isn't any listed know issue with SEP 12.1 RU4 onwards however upgrade 2-3 affected clients and let us know how it works.

Chetan,

I've upgraded close to 80% of our field with 12.1.6.1.

I just noticed the abnormality with all the duplicate IP's when reviewing the not scanned, report.