Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SEPM Clients showing Offline

Created: 23 Apr 2013 • Updated: 23 Apr 2013 | 22 comments

I am trying to connect a desktop PC to the SEPMv12 server version 12.1.2100.2093.  Servers is on that version and desktop also.

On the server I am showing the green dot and it says it is offline.  Also I am unable to delete the pc from the server.  However on the client I see that it is receiving updates and appears to be working just fine.  How do I get it to sync with the server so both are showing correctly?  I have around 400 of these clients that are showing this.  Any help would be appreciated!!!!

Operating Systems:

Comments 22 CommentsJump to latest comment

.Brian's picture

If you open the GUI on the SEP client and go to Help >> Troubleshooting, what does it show under Server?

Does it show connected to the SEPM?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

.Brian's picture

And if you do a search for it in the SEPM, does it show up twice? One as offline, the other as online?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

.Brian's picture

Interesting. The clients are connecting just not showing this in SEPM. Did you upgrade from a previous version?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

kaknarr's picture

Yes I upgraded the server from 12.1.671.4971 to 12.1.2100.2093.

Now it is time to start rolling out the new version to the clients.  So as a test I am working on my own machine to see what is needed to be done.  I did the upgrade on my machine but it is still showing as offline on the server.

Both server and desktop has been rebooted.  Also I did the upgrade to the server on 4/21.  I did my machine today on 4/23.

The odd thing on the server is its showing I have been offline since 3/29. 

.Brian's picture

The first problem is that upgrade path is not supported. You would've needed to go to 12.1 RU2 than upgrade to 12.1 RU1 MP1. It's possible something went amiss with the database or caused a cosmetic issue.

Upgrading or migrating to Symantec Endpoint Protection 12.1.2100 (RU2 MP1)

Article:TECH204449  |  Created: 2013-03-28  |  Updated: 2013-04-04  |  Article URL http://www.symantec.com/docs/TECH204449

 

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

consoleadmin's picture

Hello,

You have AD integrated network?

If it AD integrated then you need to remove it from AD then it come delete.

As your above mention snapshot clients are offline but that are duplicate entry.

If there are number of entry which are same issue then you can remove it using this

https://www-secure.symantec.com/connect/forums/dup...

 

Thanks.

technical_specialist's picture

Have you tried to delete the Entry with Console Admin ID?

Rafeeq's picture

client is not shwoing the green dot in console it might be having duplicate hardware id.

right click on the OU in SEPM and try Sync. if green dot does not comes then try this document

 

Duplicate Hardware IDs result in only one client showing up in the Symantec Endpoint Protection Manager for multiple systems

kaknarr's picture

There are NOT any duplicates.  That is not the problem. 

Also I did the correct upgrade path.  I had to do 2 seperate updates on this.  However I am now current.

Problem I am having is that I can NOT get the client and the SEPM console to communicate correctly.  The client side is showing it is receiving updates.  However the SEPM console show it has not been contacted since 3/29.  Also in the console it shows that I am unable to DELETE so then maybe I can reinitiate the connection.  Also the console is NOW not deleting old pc's.  I set it to delete anything older than 7 days.. Still have not deleted anything.

If someone could please review my screenshots above and take a look.  Also including another one here.  When I try to push an update from the console it does this.

command status.JPG

Rafeeq's picture

Did you try deleting the hardware ID what I posted in the first link? 

kaknarr's picture

Ok let me ask this.

Worst case scenario I have some corruption or whatever.  I want to start over.  Machines are doing fine as they are setup.  What would the best way to go about this with creating a new database and then having the clients connect up with the new stuff.

Appreciate all any help!!!!

Swapnil khare's picture

Hello kaknarr

 

Are these machines Clones , i meant is is this through a VM ?

Go through documents below

http://www.symantec.com/business/support/index?page=content&id=TECH163349

http://www.symantec.com/business/support/index?page=content&id=HOWTO54706

http://www.symantec.com/business/support/index?page=content&id=TECH96808

 

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

Swapnil khare's picture

Remove Hardware ID from one machine ie on the SEP Client and check if that reports to SEPM

check the zip file and troubleshooting steps. Try on one SEP client only

 

http://www.symantec.com/business/support/index?page=content&id=HOWTO54706

 

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

 

SameerU's picture

Hi

What is the version of SEPM ?

Regards

 

.Brian's picture

Per his first post

"I am trying to connect a desktop PC to the SEPMv12 server version 12.1.2100.2093"

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SameerU's picture

Hi

Please install SEP 12.1. RU2 MP1

Regards

 

KalpeshParmar's picture

you cant delete computer from SEPM Console if AD Integrated, so you have to remove it from AD

hollandg's picture

Hi Kaknarr,

I had a similar problem after upgrading SEPM from v11 to v12.1

Clients were showing up in sepm as offline, and after opening a job with symantec i was told my only option was to rebuild my sepm, an option i wasn't content with.

After searching the web i found you can access the sepm internal db by using the dbisqlc.exe tool found in this location C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\ASA\win32

Log in with DBA user account and select "Connect with an ODBC Data Source"

Once connected execute the following cmd to veiw entries for any client

SELECT * FROM SEM_CLIENT WHERE COMPUTER_NAME = '(computer name here)'

You will probably see multiple CLIENT_ID entries for clients that are off line, to fix do the following.

1. Stop smc service on client, then update sylink.xml file if it is not correct on client

2. Delete all CLIENT_ID entries in db by using following cmd

DELETE FROM SEM_CLIENT WHERE CLIENT_ID = '(client id here)'
3. Refresh SEPM console and client should be gone
4. Resync with AD and client should reappear
5. Restart smc service on client
6. Refresh the SEPM console and the client should now show as online with a green tick
 
Hope this helps
SameerU's picture

Hi

Please follow the following steps

  1. Delete %programfiles%\Common Files\Symantec Shared\HWID\sephwid.xml
  2. Open the registry and navigate to HKLM\Software\Symantec\Symantec Endpoint Protection\SMC\Sylink\Sylnk
  3. Edit the "HardwareID" value data to be blank
  4. Restart the Symantec Management Client (SMC) service in the services snap-in.

 

Regards