Client Management Suite

Hi,

Is it possible to run a report that will show duplicte machineguids on clients (latest version of CMS)

Ta.
Joe.

As the GUID is the unique key in the database, there cannot be any duplicates.

Joel,

Easiest way is to utilize the Dupliicate Guid Tool Kit
https://kb.altiris.com/article.asp?article=3848&p=1



Clay

Joe,
I take it by "latest version of CMS" you have Altiris 7...unfortunately the NS6 "Duplicate Guid Toolkit" Clay linked to above doesn't (AFAIK) work with NS7, though the concepts are the same.  I don't know that an NS7-compatible DGT has been created yet, though it would be convenient.

was the way that the system checks for possible duplicate guids, and in theory, should automatically resolve them. I still find the easiest way was to avoid them, is to not generate them in the first place, by being careful on when and how you provision the agent (but then I could just be lazy).

This isn't, per se, duplicate guids, but multiple machines receiving the same GUID, right?

The DGD in V6 works by detecting objects (defined by a single GUID) that continually change their name.

Let's say you have 3 PCs PCA, PCB, PCC.  They all have the same GUID, most likely due to poor imaging.

When PCA checks in, it will change the name attached to the shared GUID to "PCA".  Later when PCB checks in, it will do the same, likewise for PCC.  If you turn on Resource Data History for the Inv_aex_AC_identification table, you can see shared GUIDs quite clearly by a pattern of name changes.

Once you've identified the shared GUIDs, then the next step is to fix them.  That's a matter of having all of the PCs with the shared GUID reset their GUID...importantly, at the same time (regardless of timezones).  What happens then is that each of the PCs will check in without a GUID and ask for one.  The one that checked in most recently (above, PCC) will receive the shared GUID back.  The other two PCs, because they are now new objects to the DB, will receive newly generated GUIDs.

The GUID handling changed in v7:

The Altiris Agent (now Symantec Managment Agent) computes its GUID based on Hostname, Domain, MAC and Hardware (Symantec internal algorithm).

If you roll out an image to another computer the agent will drop its GUID and compute a new one (other than just use and "share" the "old" one in v6). Otherwise the DS7.1 imaging tasks would even fail to rollout new computers as they do not touch the agents configuration.

Even if you reset the agents GUID, it will compute the same again.

I didnt see any shared GUID, like in v6, for the last two years.

The GUID is NOT generated on the client.  It has not done so since the 5.x days.  What it does though is send a set of keys that are used to look-up in the database for an already matching computer.   Absent a GUID, the windows Altiris agent will send up the following keys "Name.Domain", "FQDN", and "UniqueID" where "UniqueID" is generated for each NIC using the internal algorithm.  If any of these keys already exist in the database then that is the GUID that the agent is given to use.  If none of these keys are found in the database then a new GUID is generated by the NS and given to the agent to use.   Even if just one key matches then that existing GUID is used and the remaining keys are updated.  This is why you will see the same GUID come back over and over again.

In 7 if a computer image is used with the same GUID, the server recognizes that none of the keys match the GUID that the agent is trying to use, that GUID gets "Blacklisted" forcing all agents to request new GUIDs.   The biggest issue I have seen with Blacklisting is that a computer that had the resource keys for the blacklisted guid will remain blacklisted because the keys keep giving back that same guid even through its blacklisted.  The only solution that I have for that issue is to delete that computer resource and force it to repopulate its data.  This makes since anyway given the data had been corrupted because it did mean that multiple systems had posted to one computer in the database.  I have submitted this issue and I have been assured that in 7.1 blacklisted GUIDS not only force a new GUID, but the victim computer resource is also delete so that it can also recreate its record using a new GUID. 

The blacklisting solves the issue of images with the GUID; however what still can cause duplicates are scenarios where one of the keys match even through its a different agent.  The two examples that I can think of are duel boots and VMs the uniqueid is not regenerated. (VM asks is this image a copy or was it moved which leaves the unique ids alone).   Because one key matches (seems to most often be the unqiueid), it replaces the other keys without causing a blacklist.  Also saw this issue with some comptuer systems that all had the same serial number which caused the unqiueid generated for each system to be the same.  

Hi,

It was indeed a bad build. The altiris agent was installed on the reference machine and sysprepped. so now quite a few machines have the same GUID. As these PCs are all over the site It would take a while to visit deskside. If I could find out the hostnames of these PC's I could do a /ResetGuid from my desk and hopefully this would fix the problem. As the previosue poster says DGD doesn't work in V7. How would I find these PC's

thanks for the help people :-)

update : I've resorted to finding the PCs in the unmanaged section of First time setup portal.
I run psexec \\host "C:\Program Files\Altiris\Altiris Agent\AexAgentUti
l.exe" /Clean on each machine and then just reinstall agent. long way but does the trick..

Joe.

Doesn't the "prepare for imaging" task that is part of DS7.1 do this already?
(remove ref. to the GUID in the registry).

I recall setting up a PC image, and then getting it ready to image, but it is kinda pointless to use the prepare for imaging task if it doesn't do this already.  

I setup a PC that i want to image with DS7.1 and install the agent & sub-agents i want it to have, then setup the PC the way i want to (swap file, desktop settings, etc).  
I then send it a job that runs the following tasks as instructed by your documentation:
"prepare for imaging task (which runs the sysprep tool)"
"reboot to PXE"
"create Image ABC123"
"reboot to production"

How am I supposed to correctly remove the GUID's from this PC right before sysprep runs?  If I stop the agent and remove the entires, the PC will never get the JOB!
I would hope that prepare for sysprep job does all that is mentioned in: https://kb.altiris.com/display/1n/articleDirect/index.asp?aid=16846&r=0.8577845
(grabbed from connect post: https://www-secure.symantec.com/connect/forums/altiris-agent-7x-image#comment-4467421 )

You said that "if any of these keys already exists in the database then that is the GUID the agent is given to use."  What happens if you re-use a computer name in which case the Name.Domain and FQDN would still match but the hardware is now different.  We typically re-use computer names after about 120 days.  If the GUID is still in NS will it get re-used? Even though this is a completey different system going to a different user?

While I really like the idea of it matching up the GUIDs for machines that have been re-imaged I'm worried this might cause problems with machines that are replaced and the same name is used.  I'm just trying to think of scenario's where you wouldn't want it to re-use the GUID.

thanks,

In Version 6...it will for sure.  Not 100% sure in V7, as I've seen PCs reimaged, change names, and check in and get their old GUIDs back (Serial number is now part of Basic Inventory).