Endpoint Protection

Hi,

After installing the latest SEP client and SEPM, we noticed that the Logon User or Computer is not updating. We tried to reinstall the SEP client but the problem persists wherein the current user of the workstation is not the one listed in SEPM as the logon user. What is the workaround for this issue? 

Thanks,

Jen

Is the client connected to the SEPM?

Bring up the SEP client on the affected machine and go to Help -> Troubleshooting. Does it show that it's connected to the server and is in the correct group?

Click on 'Update Policy' - does it connect? And is the date/time of the last connection most recent?

yes. all the clients are connected to SEPM. It only updates the Logon User when the user accessed the SEP client console and hit the update policy.

Check the heartbeat settings - is it enabled and the policy assigned to these clients?

Yes, all the clients are connected to SEPM and after hitting update policy it does connect and updates the time but stil SEPM is not updating the current user of the computer. It only updates when the user access the SEP client console and update the policy.

Yes, it is enabled and this policy is assigned to all of our clients

What is your exact SEPM version? This very well could've been a bug in an older version. Is this causing any impact or just in terms of reporting?

SEPM 12.1.6860.6400 is the exact version of the SEPM we have. As of now, this is the only issue we're encountering. 

I'm assuming SEP clients are also updated to the latest version too?

Also try running the SymDiag and see if there's anything odd from this point.

Yes, we have the latest version of SEP client. There was no issues reported after running SymDiag. Is it a known bug of this version? 

Don't think so, I am seeing them fine on our site.

I assume it's happening on all clients, or just some clients? If some clients what are the difference between them? (i.e. does it have any other software installed? Different firewall software?)

Have you looked at SEP logs (Systems) and is it all clear of errors?

All clients are affected. There are no errors in SEP logs.

Is this feature actually display the current user of the workstation even if he/she did not access the SEP client console?

Just tested on mine... logged on to the machine but not bringing up the SEP console and SEPM shows the latest username logged on in the client list.

So I'm not sure what is up with yours... Is Windows Firewall updated to allow traffic between clients and SEPM? (Or disabled?)

I turned off all the windows firewall of 10 clients computers here for testing but still the logon user is not updating.

One more thing to try (because I saw something similar this morning with servers) - reboot the SEPM server.

Does the logon user come back to SEPM list with the latest details?

No, it didnt update the logon user.

OK, in the case, I would suggest that you raise a support case and attach the latest logs to them, so they can do further investigation.

Would be good if they do find what the issue is, you could share it with us here. :)

Thanks.