Endpoint Protection

One of our customer has around 500 SEP clients. Each computer hostname is based on the employees name. If the employee resign and new employee is hired, what the I.T will do is to change the hostname. Right now, we are having a problem in SEP cause it seems like after changing the hostname, SEP client cannot communicate to the SEPM. What we are doing now which is a waste of time is to uninstall/install SEP on the new employee's PC? Does the SEPM really dependent on the hostname? Any help is appreciated.

hi,
client communicates with SEPM based on the sylink.xml configuration. Hence changing the SEP client name should not be any issue until there is communication issue. check the sylinkmonitor logs for any issue while you change the sep client name

After changing the computer name did u check communication between sepm and clients. 
Pls check this link to troubleshoot communication issue...

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048
https://www-secure.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

Ports used by sep
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007090614430148

How the clients are installed..? computer mode or user mode...
If u have pc's in user mode try to change it to computer mode and see...


 

Test Connection

Open a browser on the client and type the following link
http://server/secars/secars?hello,secars

Where Server - Manager's IP or Manager IP:port (If the iis website is configured to use a different port other than 80 )

If the test is successfull, you should see OK displayed on the browser.

Then you can export sylink.xml from a client group and replace it on the client.

To replace the sylink,

Use Sylink Drop
Or
Follow the below mention steps if SEP is not password Protected.

Start -> Run
SMC -stop
Replace the sylink.xml (Default Location : c:\Program Files\Symantec\Symantec Endpoint Protection)
SMC -Start

Check the client status :)

Br,
Kumar

in the SEPM server make sure the Management server list consists of both SEPM server name and IP address.
After renaming the client and rebooting try manually click update policy and see if it makes any diffrence.

If still they are not connecting to sepm.
Do paste some Sylinkmonitor logs from the client ( communication logs ) so that we can look into the exact reason.

If there are commuincation issues there is no need to uninstall and reinstall the client , just replace the sylink on the client

you can export sylink.xml from a client group 
right click on the client group -> Export Communication settings and save the file as sylink.xml

@Optimus Prime: What they've said about using the Sylink is the best way to go about it. Add that to their pre-deployment procedures for the new employees' PC. They probably should have easy access to the file in advance.

If you are using the SEP client in usermode then it is possible that your communicating to the SEPM might break after changing the hostname.

Try the sylink relace option as people have already suggested you that should help you.

And its always better then doing a complete Uninstall & reinstall :)

Yes I agreed with them replacing sylink.xml to a new one could help you to resolve your concern. instead of reinstalling it

Clients are installed in computer mode. Is the user mode / computer mode has a big effect on changing the hostname? Is this one of the reason why we're having a communication problem after  changing the hostname?

I hope you dont have AD integration. If you have try to disable it Temproraily. The reason is if AD is integrated with SEP, then the computer name should be in AD so that it will be shown in SEP

Again AD integration has nothing to do with the modes, These modes are configured in SEP

Other wise You should not have any issues because of the modes in which the client is configured.

Explanation about the modes.
Computer mode:
The client protects the computer with the same policies, regardless of which user is logged on to the computer. The policy follows the group that thecomputer is in. Computer mode is the default setting.

User mode:
The policies change, depending on which user is logged on to the client. The policy follows the user.