Hello,

We are implementing SEP 12.1.3 and I am seeing a problem on one of our test clients.  The client is not appearing in the client group it belongs in.  I run the Communication Update Package Deployment package on the client computer.  It then appears in the client list on the Management Console, then vanishes again. 

There is one one client doing this at this time, but I want to avoid this going forward.   

Thank you

Enable sylink logging and post the log here for review if you wish

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

here is the log.  Thank you

Attachment(s)

Sylink_13.zip   13 KB 1 version

That means the client has Duplicate HW ID

Follow this document

Duplicate Hardware IDs result in only one client showing up in the Symantec Endpoint Protection Manager for multiple systems

http://www.symantec.com/business/support/index?page=content&id=TECH104447

Hi

Whether the SEP client is installed on cloned image

Regards

I did find two computers with duplicate Hardware IDs.  I did correct this and both systems are showing up properly on the console.

But this brings up a bigger question.

Neither of the computers in this incident was cloned, but were existing work computers.  The two computers did not have duplicate hardware ID in SEP 11.  The SEP12 client was deployed to them by a remote push from the SEPm console. 

So the question then becomes how did the remote push generate identical hardware IDs on two different computers?  Is there a known issue with Hardware IDs using remote push?

It will be same only when its cloned. Otherwise there is no way that both will have same value.

https://www-secure.symantec.com/connect/forums/why-does-sepm-use-hardware-id-register-client

HWID is generated at the clinet end after the installation . so its not a push from SEPM.

its only if its imaged, else duplicate HW ID will not exist.

I think I have just seen it again.  Again on a computer that was not a fresh image.  I had to send a Communication Update Package on a computer and it apparently then connected with a duplicate hardware ID.  Is there anything known about this update?

I am hoping this is a mistake I am making and not a problem with the system.

If the clients have duplicate ID, one client will get registered and that info will be in DB, when other client tries to use the same ID, SEPM will reject as there is already an entry. Thats why you see green dot for a minute and then it disappears.

use this query to check the hwid in DB

SELECT * FROM SEM_CLIENT WHERE HARDWARE_KEY IN ( SELECT HARDWARE_KEY FROM SEM_CLIENT GROUP BY HARDWARE_KEY HAVING COUNT(HARDWARE_KEY) > 1) AND HARDWARE_KEY != '' ORDER BY HARDWARE_KEY;

This will show all machines where more than one hardware key is present in the database.

thank you

Will this also work on the SEP11 database or is there a different query? 

tried it on SEP11 and it did work.  thank you