Endpoint Protection

I have been using an export from the computer status log to give updates on my SEP upgrade. It was recently pointed out that my export is around 600 servers short. If I do an export from my company, I see all endpoints including the 600 missing from monitors>logs>computer status. I need to be able to show the endpoint name, IP, version, OS, as well as the def dates. i am not able to get this information from the My company export. What is causing the logs to be inaccurate? I need to be able to pull a full client inventory with sortable firelds on a regular basis.

The computer status report gives all info possible from SEPM regarding clients.

What do you mean by my company export? I only know of the computer status report so maybe I'm missing what you mean? That report should show you everything or are you referencing a different report?

What's the SEPM version?

Seems like you are using some sort of filter

computer status report will give you all the machines connect to sepm.

open -sepm-monitors-logs

computer status

select filter as default

click on advanced tab ( blue link at the bottom)

make sure that all the domains , groups , are selected, if all is selected it would show as *.

is that what you see in your current export?

SEPM version is 12.1.3 with 93% of the clients on 12.1.2.  The computer status export is not accurate.  It is missing over 600 endpoints.  I am not applying any filters, just computer status and default. I am short several hundred workstations as well.  Just not sure on total because I do not have access to a workstation inventory to figureout what endpoints are missing.   The "my company export" can be done by going to clients>my company, right clicking, search clients and do not apply any filters.  You can then export the results of every endpoint that was under my company, which is accurate.  Unfortuantely,doing it this way, only gives me Name, OS and Domain. 

I am not applying any filters and all groups (domain, computer, version, etc.) say All or *.  i am attching a screen shot of the settings I am using to pull this log

If you search (filter) for only one of the missing clients, does it show up?

yes.  If I put the name of one of the missing clients in "computer" it will show up.  I cannot figure out what the problem could be!

how many clients are in your network?

What if you set the time range to something other than 24 hours, say 1 week? Do they all show up?

13,109 clients.  I just ran both exports again. The computer status will show 11897 clients and an export from "my company" will show 13,111 clients.  i believe I have 2 duplicates that have not been deleted yet and that accoutns for the 2 that the my company export is off.

11.897 is the number of clients that have checked in to the SEPM over the last 24 hours.

Perhaps you have some clients that have been offline for longer than that or machines that have be de-commissioned that just haven't been removed yet.

How many days do you keep clients before having them automatically deleted from the SEPM?

30 days before they are automatically deleted.  that may account for some of the missing workstations but the issue is the 600 missing servers and those are never offline.  When I started looking them up one by one, they are online.

I have also ran the computer status log with "past month" "past three months" and so forth, the number of clients in the report increases but not the missing servers being inquired about.  The only time any of teh 2400+ servers we have are offline is for about an hour once a month during an outage.  I also check servers every morning for offline status in the console in case services for SEP were stopped at any point.

Do you have AD intergated with SEPM? Migthe be these clients are from OU and since they dont have SEP they dont show up in the reports?

No, I do not have AD integrated with SEPM.  The clients only check in for the first time once the SEP client is installed with the sylink to talk to the SEPMs

Is it possible to upgrade one affected client to the same version as the SEPM to see what the result will be?

No, that is not possible.  We cannot deploy the newest version outside of the SEPMs until January after the test group has ran it for a few months..  When the SEPM was 12.1.2 and the clients were the same, I had the same issue.

Also, the clients that are "missing" from the computer status export DO have SEP.  They ARE checking into the console.  The do show up on a my company export and they are online.  They just DO NOT show up on the computer status export.  I though originally it might be a limitation of the amount of fields in excel but I have checked those settings, they are fine and the my company search exports the correct client inventory.

Hmm strage !!! looks like an excel problem to me.

pick a machine which shows up under  my company. Find the group its reporting to.

create a computer status report  for this particular group only, Does the client show up?

yes the client does show up if I run the computer status against just one group.  I am going to try to run it against the entire server group and see if all 2300+ show up.

well, that will not work.  my "servers" group does not have any clients in it, jsut several sub groups under it so computer status shows 0 in the group "servers"

open -sepm-monitors-logs

computer status

select filter as default

click on advanced tab ( blue link at the bottom)

set the display limit to 1000

Click on View report

it should give you two pages, whats the count on second page..

its still shows 0 as there are no actual clients in the "server" group.  they are all in subgroups under that main group.

not my servers, for all groups *

The original computer status I have been runnign is for all groups.  When you select all, it places the * in the group filter box.  When I change it to 1000 records per page, the report has 12011 toatal endpoints