Endpoint Protection

Hi,

I have struggled some time with an issue and wonder if someone else have the similar behavior.
When we take a computer status log for all clients, about 1% of the clients shows the AV-signatures as blank. When they come back again, they update the SEPM with the signature info. We have several SEPM-environments and we have the same issue everywhere.
The findings so far are:
- Almost all clients with the issue, the clients are showing “offline” in SEPM and not responding to ping requests.
- Issue on all versions, incl RU6MP5.
- When you look into the properties of a client with the issue, the status for AV-signatures shows “not available”.
- Not all client have the issue, with 20-30000 clients offline, only 1000 of them is showing “not available”.

Can someone with a little bit bigger environment please check if you have the same behavior? It would be interesting to see if only we have this issue. :)

So are the clients valid if they're not responding to ping or some sort of network discovery? Were these imaged machines? I've seen this with imaged machines that were setup correctly - per Symantec best practices for images machines.

Hi Brian, what i want to say is that i think the issue occur when clients are disconnected from the network. When they logon again, everything is fine. The clients are not imaged.

Yea I've had this happen in the past. Usually deleting from the console clears it back up once they check-in again but it was always a manual process initially and once the DB cleared out it seemed to take.