Endpoint Protection

We just upgraded to SEP v12 recently and everything has gone smoothly.  We have 100 or so Windows 7 workstations and 8 Windows 2008 servers.  The SEPM server is a 2008 R2 member server.  We have the VIPRE Business edition product on less than 10 computers and the management server for VIPRE is a Windows 7 PC.  We have SEP on around 100 clients.  None of the computers have both products on them.  I accidentally installed SEP client on a client that runs the VIPRE client already.  I did not want both on one PC so I removed the SEP client from this PC.  Now, I still see this PC showing up in SEPM console so I deleted it... simple as that right?  But then it reappeared.  I have a feeling there is something in the registry or on the hard drive on the client that did not get completely removed in the uninstall, or perhaps it is something on the server, but something is causing this client to show up in SEPM after I delete it.  Perhaps I should simply remove VIPRE from this client and load SEP.  However, if there is an easy way to prevent this client from reappearing in SEPM, I would be grateful to anyone who could pass that along to me.

Thanks and kindest regards,

Sam

I'm assuming you removed the SEP client via add/remove programs? And the yellow shield no longer shows in the task tray?

What happens if you delete once more, does it come back?

Once you properly remove, it should not be checking back into the SEPM.

If the SEP client is removed from add/remove programs it should not reapper in sepm console. did you remove it?

for client to communicate with SEPM it needs to have Sylink.xml and it should be of complete install. corrupt install will not make the client to communicate.

For me it seems to be some duplicate id of machine with same name on your network.

If you still want to clean it up.

Call support get clean wipe utility. It would wipe out SEP from your system.

Hi

 Check the following articles.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/19590d81bdbb8e1688257354005fd693?OpenDocument

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/6ec4ff8b7c7e4fad88256dfe006cdef7?OpenDocument

 

Regards

 

if it reappears means the client is still present on the machine. can you check last heartbeat?

can you verify from add/remove program is SEP is installed.

check services as well along with process tab in task manager.

 

Hello, Are these clients mobile clients? What reason were they away from the Network so long? By Default, the SEP clients always try to connect to the SEPM as per the communication settings and Heartbeat Interval set. If in case these clients for any reason have been deleted from the SEPM Manager, these clients would re-connect to the SEPM. Symantec Endpoint Protection: The Heartbeat Process http://www.symantec.com/docs/TECH191617 Understanding Pull mode and Push mode https://www-secure.symantec.com/connect/forums/pull-mode-push-mode However, incase if you weren't aware of this issue and the clients weren't away from the network, then you may like to run the SylinkReplacer on the client machines and they would assist these clients to report back to the SEPM again. The Sylinkreplacer tool for connecting SEP clients to a SEPM http://www.symantec.com/connect/downloads/sylinkreplacer-tool-connecting-sep-clients-sepm OR Follow the Manual Instructions - How to change a Symantec Endpoint Protection client from unmanaged to managed http://www.symantec.com/docs/TECH90761 Hope that helps!!

Hi

Can you please update on the provided solution

Regards

 

HI, 

Have you removed the SEP from the particular client?

client will communicate to SEPM using sylink.xml file.

Regards

Ajin

When this client reappear is it showing online/offline?

have you seen the ip of both are same?