Endpoint Protection

Hello,

Our environment have a lot of duplicates that have been created over time and this will continue to happen.  I understand why that happens (cloing etc), What I am curious about is the following:

1.   What are the disadvantages in turning down the client age to 1 days in SEPM? Are there any?

2.  Is there a script that anyone has created that goes out and finds duplicates and only deletes the ones that are offline?

Well if a client goes off for more than 1 day it gets removed. I guess there isn't a big disadvantage, other there isn't a great reason to do. As for the dups, were these imaged?

No script that I've seen or know of.

The main disadvantage of switching the client deletion threshold to one day is that you can't really move clients around effectively.

If you move a client to another group and the record gets deleted over the weekend, it'll check-in and drop back into the "Preferred Group" in the sylink file on Monday (and revert back to whatever policies are there).

Still, bringing the threshold down remains the cleanest way of removing stale/orphaned records, so you'd probably be best off taking down to 1 day, leaving it for 1 working day, then bringing it back up to a normal threshold.

Why are you getting the duplicates anyway?  Is this a VDI environment?  Have you checked out the smaller threshold that can be applied to non-persistent VMs?

Here is the query to find the duplicates once you find them you can use the move client utility to move them and then delete them

https://www-secure.symantec.com/connect/articles/how-find-duplicated-hardware-ids-database

Move client

http://www.symantec.com/business/support/index?page=content&id=TECH157429

From the sounds of it, the OP is after a acript to remove duplicate records (i.e. multiple client records all with the same name), not identify multiple clients all reporting in with the same HWID.

I may be incorrect, but that's how I understood it