Endpoint Protection

Hi all,

I've been working on a issue now for some time where the SEP 11 clients are not showing in the SEPM interface. I've tried a search in all groups from the GUI and a manual search in all folders and the server doesn't show BUT here is the strange thing, if I run a report COMPUTER STATUS report against all groups and filter this down I can see the Server and the defination date, which is all correct and upto date. Therefore is commuicating to the management server just not showing in the SEPM GUI meaning the firewall rules hardwareID etc can be ruled out. 

Regradless I've still tried recreated the hardware ID as stated in the link below

http://www.symantec.com/business/support/index?page=content&id=TECH97626

All this did was duplicate the server within the REPORT ONLY the client still didn't show in the SEPM GUI via both manual and search all groups for computer name LIKE XXXXXXXXX

Help....Thanks Wayne

HI,

Are you using Image OS ?

Try to this Document.

Image Installation System Problem

https://www-secure.symantec.com/connect/downloads/image-installation-system-problem

Script Convert unmanaged system to Managed system

https://www-secure.symantec.com/connect/downloads/script-convert-unmanaged-system-managed-system

Hi Ashish,

Thanks but I've already recreated the hardware ID and changed the clients from managed to unmanged and back to managed. As stated it is communicating to the management server but only shows if i run a report from the monitors and log option not from the SEPM console / interface.

Regards

hi,

Once again you can follow this steps 2 or 3 systems and check.

Windows firewall should be off ?

Once I recreate the hardware ID and rerun the report it duplicates the client but still does not show in the SEPM console.

can you search in SEPM console, does it shows up?

HI,

Once you can run unmanaged detector and checked this system are showing or not ?

If I logon to the SEPM console choose Clients the right click search clients. In the search field I'm using computer name, Operator is LIKE and Value I'm putting the full and I've tried part of the server name. Nothing shows blank.

BUT

If I run the report from Monitors, Logs and log type Computer Status and put a * in all fields export this to a CSV file and search it shows me the client.

Running the unmanaged detector against the server name and IP comes back blank it both unamanged computers and unknown computers.

HI,

After Delete Hardware id you have replace Syslink.xml ?

Try to remove sep client and reinstall client ?

The syslink was deleted, I really don't what to uninstall and reinstall I have this problem on about 40 production servers.

Hi,

Try to export new syslink.xml for sep group and replace SEP client when you will be delete hardware id.

This has just duplicated the server in my exported report I now have 3 servers with the same name but none of them are showing in the SEPM console via the search option.

I had a case open with Symantec for some time now they have not manged to resolve this yet I was hoping someone may of come accros this.

HI,

Need to delete SEPM client automatically in SEPM server.

 Solution

1. SEPM Server.
2. Admin TAB.
3. Server TAB.
4. Local site properties.
5. Choose to General setting and check mark Delete Clients that have not connected for (30 for you requirement) days.
6. After this setting all client remove automatically in your SEPM database server.

After Duplicate Client not showing in sepm report.

Try to export new syslink.xml for sep group and replace SEP client when you will be delete hardware id.

Windows firewall on or off ?

The remove clients after 30 days has been ticked since day one of the SEP 11 installation. Windows firewall is disabled on both client and management server.

I completed the above steps regardless and I now have 4 (everytime I recreate the hardware ID this number is increasing) duplicate clients ONLY in my newly exported CSV file. Still nothing showing in the SEPM console.

HI,

Check SEP client which group showing ?

The SEP client is showing in the default group on the right management server and showing as a managed client. This is also what the export report is showing. I have manually searched and used the search function on the group in the SEPM console and it's not showing.

HI,

Check sep Default group Properties ->UnCheck Blocked New Clients.

This option has never been checked in any of are groups. But thanks for mentioning it.

HI,

We have try all of think but not received solution.

Please raised support ticket..

Please contact Symantec Technical Support via the support phone numbers listed below

Regional Support Telephone Numbers:
United States: https://support.broadcom.com (407-357-7600 from outside the United States)
Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
United Kingdom: +44 (0) 870 606 6000
Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp   India: Toll-Free 000 800 4401 456 directly                                                                                                       

Contact Symantec Customer Care on 

http://www.symantec.com/support/assistance_care.jsp

OR 

Technical Support

http://www.symantec.com/business/support/contact_techsupp_static.jsp

Try the below steps.

--Checked the client status: offline
--Took the backup of the registry
-- Delete the following registry keys:
HKEY_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
HKEY_USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
--Set the proxy enable in the registry to 0 under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
--Uncheck the proxy setting option in the internet options settings.
--Reboot the system.
--Check the client status : online/reporting to the server

Do you have multiple SEP domains? If so, maybe they are reporting to another SEP domain?

Have you tried this?

http://www.symantec.com/business/support/index?page=content&id=TECH163349

If that doesn't work, then is your SEPM using SQL or the internal db? If SQL, do you have access to the SQL Server Management Studio and feel comfortable running a query on the SEPM database? If so, run the following SQL query and find the servers that are not showing in the console. Change database name to the name of your SEPM database.

Check the server entries for matching computer_name, Domain_ID, Computer_ID, hardware_key, or Deleted. 

• If there is a 1 under deleted, that is why they do not display in SEPM.
• If the computer_names you are looking for have the same computer_id, that would be a problem
• If the computer_names you are looking for have the same hardware_key, that would also be a problem

SELECT [COMPUTER_ID], [DOMAIN_ID], [HARDWARE_KEY], [COMPUTER_NAME],[COMPUTER_DOMAIN_NAME], [DELETED]

FROM [databasename].[dbo].[SEM_COMPUTER]

One other thing I didn't think of at first - what mode are those computers in - user or computer? I just did a test on my SEPM and if I search for a computer name for a SEP client that is in user mode, SEPM won't find it.

Use this SQL query to add Policy Mode and User Name to the results (Change [databasename] to the name of your SEPM database):

SELECT [COMPUTER_ID], [DOMAIN_ID], [HARDWARE_KEY], [COMPUTER_NAME],[COMPUTER_DOMAIN_NAME], [POLICY_MODE], [USER_NAME], [DELETED]

FROM [databasename].[dbo].[SEM_COMPUTER]

If Policy_Mode returns a 0, then those computers are in User mode and are not searchable in SEPM by computer name. USER_NAME is one of the fields being returned in the query above, so you could search SEPM for the user name to find those servers. Once you find them, you can right-click them and "Switch to Computer mode".

Hello,

Is the SEPM in sync with AD? if yes, were there any changes made in the AD?

Could you check if you are carrying you have 2 domains within SEPM?

You could check the same by:

SEPM >> Admin >> Domains

By default, you have only Default Domain.

Incase, if you see 2 domains, highlight the second domain and click on "administer" and then Click on Clients TAB.

I would suggest you to check this Article - 

About domains http://www.symantec.com/docs/HOWTO55042

Adding a domain http://www.symantec.com/docs/HOWTO55444

Setting the current domain http://www.symantec.com/docs/HOWTO55044

Hope that helps!!

This has been a great help but has opened more questions. I exported the below query

SELECT [COMPUTER_ID], [DOMAIN_ID], [HARDWARE_KEY], [COMPUTER_NAME],[COMPUTER_DOMAIN_NAME], [DELETED]

FROM [databasename].[dbo].[SEM_COMPUTER]

[POLICY_MODE], [USER_NAME] kept displaying an error please advise on this.

used conditional formatting to display the duplicates on both Hardware ID and computer name out of 1760 records I had 2 duplicate hardwareID and 18 computer names. 15 of the servers cannot be found within the SEPM console. Only using the above query...

The record the the sepm console is display are not the same as the database records..e.g the database is telling me I have 1760 records

SEPM console tells me i have 1448 records..... thats a big differents..

I have verified I'm looking at the correct database because I know it seems I'm not....

We only have the one domain in SEPM.

What about the Deleted field? Did any computers/servers show a 1 in that field? If yes, those computers/servers won't appear in the console.

For those computers that are showing as duplicate hardware IDs, follow the kb for deleting the registry key and check both to ensure their hardware keys get re-created, and are different on each one. Then, check to see if they appear in SEPM.

Had to restore an older v11 database to find out what went wrong with the query. Seems they changed things around in v12.1... Imagine that.

Try this query to check Policy Mode for those servers (Again, change [databasename] to reflect your database):

SELECT [CLIENT_ID], [DOMAIN_ID], [GROUP_ID], [POLICY_MODE], [COMPUTER_ID], [HARDWARE_KEY], [COMPUTER_NAME], [COMPUTER_DOMAIN_NAME], [USER_NAME]

FROM [databasename].[dbo].[SEM_CLIENT]

In this query is the group_id. For those computers that have duplicate names or duplicate hardware ids, do any of them appear in those groups? To find the correct group, you'll have to find another computer where you know the group it is in and check there.

One other thing to check - are you using the Java console or web console? If using the Java console, are you using the version of Java compatible with SEPM v11? If using the web console, are you using the version of IE that is compatible with SEPM v11? I have had issues before when I upgraded my Java or browser. I wouldn't think it would cause this issue, but you never know. A good Win32/Win64 app would be greatly appreciated.

Along those lines, you might try deleting your Java and browser caches to see if you get the same results.

Thank You dsmith1954 the clients have been installed as user mode and not computer mode..your query has hightlighted all the ones I need to rectify, only 402 servers oh well keep me busy...

Thank you all for your help with this..