Endpoint Protection

I am running SEPM 12.1.3 and I have imported some OUs from Active Directory. One of the OUs I have imported I copied the machines in that OU to manually created groups in the SEPM. When I copy the machine from the imported OU to the manually created group, the imported machine shows inactive and the copied machine shows active (as it is supposed to). The next day when I log into SEPM and I check the machines I copied to the mnaully created group they no longer show active and when I check the imported group the machines show active. I will then again copy the machines from the imported group to the manually created group and the next day the same thing will happen. This does not happen to all the machines I have imported just a few of them. Why once I copy the machines are they not staying active in the manually created group I copied them to?

So basically it sounds like for any machine imported from AD, they go back to their AD group while the non AD imported machines stay in the group you created?

Yes, that is correct. But it only happens to a few machines, not all of them that I imported.

Are they all on the same version (RU3)? Or are the clients on different versions?

They clients are all on the same version. I just finished updating them yesterday.

For the machines that are reverting back to the imported OU, can you check if the HWID (Unique ID) matches/changes between the copy in the custom group, and the active client record one in the imported OU?

If the HWID is different, then that is the reason the client is swapping back, and you should investigate why the HWID is changing.

If the HWID matches, then I'd suggest grabbing the sylink logs of the endpoints in question.

Hi, 

Are all they having same version?

Regards

AJin

Yes, I already asked that:

https://www-secure.symantec.com/connect/forums/machines-imported-ou-not-stay-group-when-copied#/comment-8977141

They are on the same version.

The machines have the same Hardware Key but different Unique IDs.

In thta case, can you enable and grab the sylink logs for the clients in question please?

http://www.symantec.com/docs/TECH104758