Hey guys,

I'm having a weird issue, last day I had 195 clients, the next day I lost 5 making it only 190. I dont know how it got gone, I checked the aloted time for the SEP client to erase clients that is conteniously offline and it was set to 30 days like the default. Anyone have an idea?

Thanks,

Were these machines imaged/cloned?

Is the client connected to the SEPM currently?

I'm not sure, but there probably are, what's the effect on cloned machines?

hello,

Yes I agree brian kindly confirm are you using clone system ?

Check this artical help you.

How to prepare a Symantec Endpoint Protection 12.1 client for cloning

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

What shows up if you do a search for them in the SEPM?

Similar thread here:

https://www-secure.symantec.com/connect/forums/sep-12-clients-keep-showing-dissapearing-sepm-console

You get clients with duplicate identifiers and it causes problems with clients and reporting into the console.

http://www.symantec.com/docs/HOWTO54706

Hello,

By Default, the SEP clients always try to connect to the SEPM as per the communication settings and Heartbeat Interval set.

If in case these clients for any reason have been deleted from the SEPM Manager, these clients would re-connect to the SEPM.

Symantec Endpoint Protection: The Heartbeat Process

http://www.symantec.com/docs/TECH191617

Understanding Pull mode and Push mode

https://www-secure.symantec.com/connect/forums/pull-mode-push-mode

However, incase if you weren't aware of this issue and the clients weren't away from the network, then you may like to run the SylinkReplacer on the client machines and they would assist these clients to report back to the SEPM again.

The Sylinkreplacer tool for connecting SEP clients to a SEPM

http://www.symantec.com/connect/downloads/sylinkreplacer-tool-connecting-sep-clients-sepm

OR

Follow the Manual Instructions - 

How to change a Symantec Endpoint Protection client from unmanaged to managed

http://www.symantec.com/docs/TECH90761

In case these are Imaged / Clonned clients, you may like to check these Articles:

How to prepare a Symantec Endpoint Protection 12.1 client for cloning

http://www.symantec.com/docs/HOWTO54706

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

http://www.symantec.com/business/support/index?page=content&id=TECH163349

Hope that helps!!

Guys,

We're not using cloned image. Which makes it odd, I alredy know about the cloned machine issue and it's resolution, it was one of our problem in one of our other client.

Anything?

Thanks,

Hi,

Did you check effected client are showing online or offline ?

try to replace sylink.xml and remove hardware id.

Hi,

We cant see that since the affected client are missing. And we cannot locate the physical location of the workstation since it got missing.

Thanks,

Hello,

In that case, you can find these clients by "Unmanaged detector"

Upon booting, a computer sends out Address Resolution Protocol (ARP) traffic to identify itself on a network. Once enabled, the Unmanaged Detector listens for gratuitous ARP traffic and collects Internet Protocol (IP) and Machine Address (MAC) data from traffic passing it on the local network. This data is then forwarded to the Unmanaged Detector’s SEPM which compares the IP address and MAC address of detected systems against its known list of managed endpoint clients and reports on the unmanaged endpoint clients.

An unmanaged detector is configured by right-clicking a managed SEP client in the Clients page of the SEPM console, and selecting "Make unmanaged detector".

Best Practices: When to use the "Find Unmanaged Computers" or "Unmanaged Detector" features in Symantec Endpoint Protection 11.0

http://www.symantec.com/docs/TECH104340

What does it mean to set a client as an Unmanaged Detector

http://www.symantec.com/docs/TECH105722

How Unmanaged Detector works?

https://www-secure.symantec.com/connect/forums/how-unmanaged-detector-works

Hope that helps!!