Endpoint Protection

 View Only
  • 1.  Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 09:23 AM

    I recently was assigned responsibility for managing the desktop end of our Symantec Endpoint Protection installation (v. 12.1.4).  I have our Windows machines under control, but I seem to be having an issue with the Macintosh end.

    I've noticed that Macintosh machines will occasionally pop into our default group.  When I move them into the Mac group I created, I can see a previous entry for them.  I'm guessing this is because the Hardware ID is getting recreated somehow, but I can't find any documentation of HWID issues on Macs.

    Has anyone else experienced this?  Can I at least get a decent disection of Mac installations so I can try to troubleshoot this myself?

    Thanks!

    /Mike



  • 2.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 09:26 AM

    Similar to this?

    http://www.symantec.com/docs/TECH211606



  • 3.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 09:33 AM

    We aren't uninstalling/reinstalling anything.

    This is just happening seemingly at random.  I can certainly continue to delete the old entries and move the new entry to the group, but it doesn't explain why one of my clients is creating a new HWID without any prompting from the console.

     

    I know on the PC, the HWID  is stored in the registry as well as in a seperate file and it doesn't get recreated unless you remove both.  How is this stored  on a Macintosh client?  What would prompt the client to generate a new HWID?



  • 4.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 09:44 AM

    Macs can be cloned. Can you check if these are new macs which are cloned?.

    Deploying Symantec Endpoint Protection for Macintosh as part of a drive image

    http://www.symantec.com/business/support/index?page=content&id=TECH134676



  • 5.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 10:34 AM

    These machines are cloned, but I would expect that any problem would be apparent after the machine first logs onto the network.  Instead, some of these machines are deployed for months and then randomly they get a new hardware ID and get added to the default group instead of the Mac group that they are set to be part of.  

    I've forwarded your link to our Macintosh Systems Administrator for confirmation, but I still think that it sounds like something else is going on here that is making changes to random individual clients creating a new Hardware ID and pushing them into a different group than they were set for...



  • 6.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 10:42 AM

    with duplicate hardware ID , the problem ( in windows) is that you would see only one machine online in SEPM, rest will be offline in SEPM console. Though they are offline it would still receive policy.  since they all have same HWID ( which is required during sepm registration) they all end up being duplicates and do not know any preferred group to endup with.

    Since HWID is unique SEPM uses this to register clients.



  • 7.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 01, 2014 11:33 AM

    Yes, I understand that.  I've dealt with this issue on PCs before and resolved it.

     

    This Mac issue is different.  The Mac is connecting for months with a specific HWID.  Then randomly, something happens to the desktop client and it generates a new HWID and gets added to the default group instead of the Mac Group - so I now have 2 entries (one that is current and wrong, and one that is correct and doesn't work because it is registered to an old now non-existant HWID.  

     

    I am trying to figure out why this happens and how to stop it.



  • 8.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 25, 2014 08:39 AM

    It's still happening.  I came in this morning to find that 10 Mac randomly moved from the Mac Clients group we set up over to the Default Group.

     

    If we check the clients that have moved, their .plist somehow changed/defaulted/reset, but we can't figure out how or why this is happening. No tech is making a change/deleting the list/etc.  This just doesn't make sense.



  • 9.  RE: Hardware IDs keep getting recreated on Macintosh clients

    Posted Aug 25, 2014 11:20 AM

    Any chance you are using AD integration in your SEPM?

     Or is this a group you created locally in your SEPM?

    SEP for Macintosh FAQ

    http://www.symantec.com/docs/TECH134203

    MJD