Video Screencast Help

SEP Client duplicates

Created: 02 Apr 2013 • Updated: 08 Apr 2013 | 9 comments
D@ry1's picture
This issue has been solved. See solution.

Hi Guys,

 

Do you know what's the cause of the sep clients duplicating on the SEPM? it seems that the hardware id is the reason but why is the hardware ID changing in the first place? please we need a quick solution for this if possible give us direct answer instead of links, we're on rush right now,.

 

Thanks,

Operating Systems:

Comments 9 CommentsJump to latest comment

K33's picture

hi,

There are two causes for this issue:

Current Theory: The first possible cause for this is when an Endpoint has been re-imaged (whether in a virtual machine or on a physical system).

Things we know: Each installation of Symantec Endpoint Protection (SEP) randomly creates a "Unique Identifier" for the client. So if this changes and the re-imaged system checks in, it is recognized as a new client.

Example: The IP and computer name are the same, yet the database still shows a different Unique ID.

The second cause for this is related to an issue with moving clients to a different OU in Active Directory.

Check this artical

https://www-secure.symantec.com/connect/articles/d...

 

https://www-secure.symantec.com/connect/forums/avo...

D@ry1's picture

Hey,

 

We're running on physical machines, anything else?

 

Thanks,

K33's picture

hi,

You can avoid this problem

Check this artical how to prepare image syetem

How to prepare a Symantec Endpoint Protection 12.1 client for cloning (image)

http://www.symantec.com/docs/HOWTO54706

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

http://www.symantec.com/docs/TECH163349

 

https://www-secure.symantec.com/connect/forums/avo...

D@ry1's picture

Hi,

 

I'm looking for the cause of this problem I hope you can help me,.

 

Thanks,

Chetan Savade's picture

Hi,

You are correct duplicate hardware id is the reason.

This article you can try to clear duplicate hardware id.

How to prepare a Symantec Endpoint Protection 12.1 client for cloning (image)

http://www.symantec.com/docs/HOWTO54706

& to avoid this issue in future you can always refer this article.

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

http://www.symantec.com/docs/TECH163349

Chetan Savade
Sr Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

D@ry1's picture

Hi'

 

I'm looking for the cause of this problem.

 

Thanks,

Mithun Sanghavi's picture

Hello,

Check this Article:

Duplicate SEP clients appear in the Symantec Endpoint Protection Manager console

https://www-secure.symantec.com/connect/articles/duplicate-sep-clients-appear-symantec-endpoint-protection-manager-console

There are two causes for this issue:

Current Theory: The first possible cause for this is when an Endpoint has been re-imaged (whether in a virtual machine or on a physical system).

Things we know: Each installation of Symantec Endpoint Protection (SEP) randomly creates a "Unique Identifier" for the client. So if this changes and the re-imaged system checks in, it is recognized as a new client.

Example: The IP and computer name are the same, yet the database still shows a different Unique ID.

The second cause for this is related to an issue with moving clients to a different OU in Active Directory.

Duplicate Endpoint Protection client IDs occur if the base image was not prepared for cloning. For more information, read the article How to prepare a Symantec Endpoint Protection 12.1 client for cloning.

However to Resolve this issue, check these Articles for SEP 12.1: -

How to repair duplicate IDs on cloned Symantec Endpoint Protection 12.1 clients

http://www.symantec.com/docs/TECH163349

Duplicate SEP clients appear in the Symantec Endpoint Protection Manager console

https://www-secure.symantec.com/connect/articles/duplicate-sep-clients-appear-symantec-endpoint-protection-manager-console

To prevent this from happening, I would recommend you to prepare your clients before cloning /image, check this article:

How to prepare a Symantec Endpoint Protection 12.1 client for cloning (image)

http://www.symantec.com/docs/HOWTO54706

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

SOLUTION
D@ry1's picture

Hi,

 

I get it now, but what do you mean by this? "So if this changes and the re-imaged system checks in, it is recognized as a new client."? I dont quite get it. Can you give a scenaio?

 

Thanks,

Mithun Sanghavi's picture

Hello,

No. You are suppose to make sure you have the base image settings done properly.

To prevent this issue from happening, I would recommend you to follow the below document which lists the best practices for cloning a Symantec Endpoint Protection 12.1 client in either a physical or virtual environment. 

If this document is not followed then cloned Endpoint Protection clients will have duplicate identifiers, which will result in problems with management and reporting.

Check this article:

How to prepare a Symantec Endpoint Protection 12.1 client for cloning (image)

http://www.symantec.com/docs/HOWTO54706

Hope that helps!!

Mithun Sanghavi
Senior Consultant
MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.