SEP 12 Clients keep showing up & dissapearing from the SEPM console

Created: 14 Mar 2013 | Updated: 14 Mar 2013 | 5 comments

Sylviu84

Hello ,

I have a problem with a whole list of clients (all servers , did not check workstations , all having SEP 12 installed) that are not showing up in my SEPM 12 console (searched by username, hostname, OS , IP ...) . I checked the AV locally , on the clients and it showed up as managed , connected to the (right) SEPM , even indicating the folder it belongs to in the console (under troubleshooting) . As soon as I hit the "connect now" button , the last communication date gets updated and the server shows up in the console , with my username associated . All good so far ... glad that the problem was solved ...i went ahead and did the exact same thing on the next client ... the client turned up in SEPM , in the folder it was supposed to ....but at the same time i noticed that the first client i did that on was gone .... went back to it , repeated the action , only to see that the other client was gone ...

So only the last server i perform this action on remains in the console ... thought the problem might be that their are all in user mode ...but when i right click them i get the option to "switch them to user mode" so that means they're already in computer mode ...

Don't know if i provided enough details ... but i really need help with this .

any hint / idea is most appreciated

regards

Operating Systems:

Windows Server (2003/2008)

Discussion Filed Under:

Security, Endpoint Protection (AntiVirus) - 12.x, Endpoint Protection (AntiVirus), Agents, Reporting, Troubleshooting, Windows Server (2003/2008)

Login or register to post comments
Comments RSS Feed

Comments 5 Comments • Jump to latest comment

Brian81 Trusted Advisor

SEP 12 Clients keep showing up & dissapearing from the SEPM console - Comment:14 Mar 2013 : Link

Can you enable sylink logging on one machine and go thru same procedure you did to get them reporting in. Than post log here

SEP Knowledge Base

Endpoint SWAT

admin_sepm

SEP 12 Clients keep showing up & dissapearing from the SEPM console - Comment:14 Mar 2013 : Link

Hello from client side these are reflecting online status?

https://www-secure.symantec.com/connect/forums/sep-121-clients-not-appearing-sepm-121-console

Troubleshooting Client Communication with SEPM

Article:TECH95789

Created: 2009-01-26

Updated: 2012-01-03

Article URL http://www.symantec.com/docs/TECH95789

How to change the sylink.xml file in Symantec Endpoint Protection (SEP) 12.1

Article:TECH157585

Created: 2011-04-07

Updated: 2012-06-07

Article URL http://www.symantec.com/docs/TECH157585

Thanks.

SameerU Partner Accredited

SEP 12 Clients keep showing up & dissapearing from the SEPM console - Comment:26 Mar 2013 : Link

Please perform the following steps

Stop SMC on both of the affected client computers by clicking Start > Run, type smc -stop then click OK.
On the SEPM console, delete the client entry that the two computers have been sharing. This will prevent the client duplication that would otherwise occur due to the following steps.
On each of the affected computers, go to registry location:
- HKLM\Software\Symantec\Symantec Endpoint Protection\SMC\Sylink\Sylink
Clear the value for "Hardware ID." (make it blank)
Disable Tamper Protection if you are unable to edit the value.
On each of the affected computers, navigate to the following directory location:
- SEP 11 Location:
  - C:\Program Files\Common Files\Symantec Shared\HWID
- SEP 12.1 Location:
  - Windows XP/2003: C:\Documents and Settings\All Users\Application Data\Symantec\Persisted Data
  - Windows Vista/7/2008: C:\Program Data\Symantec\Symantec Endpoint Protection\Persisted Data
Find file "sephwid.xml". Rename it to "sephwid.xml.bak".
Start SMC on each computer by clicking Start > Run, type smc -start then click OK.
Check the SEPM console for the new SEP client
- When the clients check in they should have unique hardware IDs.