Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEPM client reappeared after deletion

Created: 31 Jul 2013 • Updated: 27 Aug 2014 | 8 comments
This issue has been solved. See solution.

We just upgraded to SEP v12 recently and everything has gone smoothly.  We have 100 or so Windows 7 workstations and 8 Windows 2008 servers.  The SEPM server is a 2008 R2 member server.  We have the VIPRE Business edition product on less than 10 computers and the management server for VIPRE is a Windows 7 PC.  We have SEP on around 100 clients.  None of the computers have both products on them.  I accidentally installed SEP client on a client that runs the VIPRE client already.  I did not want both on one PC so I removed the SEP client from this PC.  Now, I still see this PC showing up in SEPM console so I deleted it... simple as that right?  But then it reappeared.  I have a feeling there is something in the registry or on the hard drive on the client that did not get completely removed in the uninstall, or perhaps it is something on the server, but something is causing this client to show up in SEPM after I delete it.  Perhaps I should simply remove VIPRE from this client and load SEP.  However, if there is an easy way to prevent this client from reappearing in SEPM, I would be grateful to anyone who could pass that along to me.

Thanks and kindest regards,

Sam

Operating Systems:

Comments 8 CommentsJump to latest comment

Rafeeq's picture

If the SEP client is removed from add/remove programs it should not reapper in sepm console. did you remove it?

for client to communicate with SEPM it needs to have Sylink.xml and it should be of complete install. corrupt install will not make the client to communicate.

For me it seems to be some duplicate id of machine with same name on your network.

If you still want to clean it up.

Call support get clean wipe utility. It would wipe out SEP from your system.

.Brian's picture

I'm assuming you removed the SEP client via add/remove programs? And the yellow shield no longer shows in the task tray?

What happens if you delete once more, does it come back?

Once you properly remove, it should not be checking back into the SEPM.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

pete_4u2002's picture

if it reappears means the client is still present on the machine. can you check last heartbeat?

can you verify from add/remove program is SEP is installed.

check services as well along with process tab in task manager.

sai_india's picture

Hello,

Are these clients mobile clients? What reason were they away from the Network so long?

By Default, the SEP clients always try to connect to the SEPM as per the communication settings and Heartbeat Interval set.

If in case these clients for any reason have been deleted from the SEPM Manager, these clients would re-connect to the SEPM.

Symantec Endpoint Protection: The Heartbeat Process

http://www.symantec.com/docs/TECH191617

Understanding Pull mode and Push mode

https://www-secure.symantec.com/connect/forums/pul...

However, incase if you weren't aware of this issue and the clients weren't away from the network, then you may like to run the SylinkReplacer on the client machines and they would assist these clients to report back to the SEPM again.

The Sylinkreplacer tool for connecting SEP clients to a SEPM

http://www.symantec.com/connect/downloads/sylinkre...

OR

Follow the Manual Instructions -

How to change a Symantec Endpoint Protection client from unmanaged to managed

http://www.symantec.com/docs/TECH90761

Hope that helps!!

SameerU's picture

Hi

Can you please update on the provided solution

Regards

AjinBabu's picture

HI, 

Have you removed the SEP from the particular client?

client will communicate to SEPM using sylink.xml file.

Regards

Ajin

AJ_01's picture

When this client reappear is it showing online/offline?

have you seen the ip of both are same?

Regard

AJ