Video Screencast Help

SEP12 client not staying connected to management console

Created: 30 Aug 2013 • Updated: 05 Sep 2013 | 13 comments
This issue has been solved. See solution.


We are implementing SEP 12.1.3 and I am seeing a problem on one of our test clients.  The client is not appearing in the client group it belongs in.  I run the Communication Update Package Deployment package on the client computer.  It then appears in the client list on the Management Console, then vanishes again. 

There is one one client doing this at this time, but I want to avoid this going forward.   

Thank you

Operating Systems:

Comments 13 CommentsJump to latest comment

Brɨan's picture

Enable sylink logging and post the log here for review if you wish

How to enable Sylink debugging for the Symantec Endpoint Protection 11.x and 12.1 client in the Windows Registry

padding: 1px;padding-bottom: 3px ;font: 12px Arial; text-align: left;">Article:TECH104758 padding: 1px;font: 12px Arial; text-align: left;"> |  padding: 0px;font: 12px Arial; text-align: left;">Created: 2008-01-18 padding: 1px;font: 12px Arial; text-align: left;"> |  padding: 1px;font: 12px Arial; text-align: left;">Updated: 2013-02-26 padding: 1px;font: 12px Arial; text-align: left;"> |  padding: 1px;font: 12px Arial; text-align: left;">Article URL

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Rafeeq's picture

That means the client has Duplicate HW ID

Follow this document

Duplicate Hardware IDs result in only one client showing up in the Symantec Endpoint Protection Manager for multiple systems

SameerU's picture


Whether the SEP client is installed on cloned image


Far North Eric's picture

I did find two computers with duplicate Hardware IDs.  I did correct this and both systems are showing up properly on the console.

But this brings up a bigger question.

Neither of the computers in this incident was cloned, but were existing work computers.  The two computers did not have duplicate hardware ID in SEP 11.  The SEP12 client was deployed to them by a remote push from the SEPm console. 

So the question then becomes how did the remote push generate identical hardware IDs on two different computers?  Is there a known issue with Hardware IDs using remote push?

Rafeeq's picture

It will be same only when its cloned. Otherwise there is no way that both will have same value.

HWID is generated at the clinet end after the installation . so its not a push from SEPM.

Far North Eric's picture

I think I have just seen it again.  Again on a computer that was not a fresh image.  I had to send a Communication Update Package on a computer and it apparently then connected with a duplicate hardware ID.  Is there anything known about this update?

Far North Eric's picture

I am hoping this is a mistake I am making and not a problem with the system.

Rafeeq's picture

If the clients have duplicate ID, one client will get registered and that info will be in DB, when other client tries to use the same ID, SEPM will reject as there is already an entry. Thats why you see green dot for a minute and then it disappears.

use this query to check the hwid in DB


This will show all machines where more than one hardware key is present in the database.

Far North Eric's picture

Will this also work on the SEP11 database or is there a different query?