Client Management Suite

 View Only

  • 1.  Some computers doing UNWANTED Wake-On-Lan

    Posted Aug 05, 2013 11:16 AM

    Hi, 

     

    Since a couple of months we have a handful of computers doing a Wake-On Lan at 6AM in the morning and we can't figure out what's triggering it. We have discovered with WireShark that it is our Altiris Notification Server sending out the WOL package, but I can't find which task or policy it is. I suppose it is a policy because 6AM is an hour that we use sometimes to start a rollout, and tasks is something that we hardly use (unless it could be a built-in task for agent installations or something similar). 

     

    The problem is that I can't find anything that powers on the computers. I've been looking through our SQL database to see if I can find something interesting in the tables concerning power-on tasks, but I didn't find something useful to write a query to find which policies do power-on... 

     

    Any help here would be greatly appreciated. Thanks!



  • 2.  RE: Some computers doing UNWANTED Wake-On-Lan

    Posted Aug 05, 2013 11:51 AM

    You may be suffering from this issue:

    "The WOL being called by this option in the policy is a broadcast to all computers on the local subnet. If there are targeted computers not on the local subnet then the SMP server will use a WOL proxy on the remote subnet to broadcast the WOL packet to all computers on that remote subnet.

    This is working as designed. However, the design is not optimal."

    http://www.symantec.com/docs/TECH199794



  • 3.  RE: Some computers doing UNWANTED Wake-On-Lan

    Posted Aug 06, 2013 03:42 AM

    Hello andykn101 and thank you for your quick reply. 

     

    Not all our computers are affected, it only happens to a handful as far as we know. And the problem is that I can't find software delivery policies where the option to wake computers is turned on. Would there be a way to filter those policies or to do it in a SQL query?



  • 4.  RE: Some computers doing UNWANTED Wake-On-Lan

    Posted Aug 06, 2013 04:44 AM

    We have found an internal calendar in Altiris NS where we can clearly see that at 6am a WOL task is sent for a managed software delivery, but it only shows the GUID. I'm looking for a way now to find the name of the delivery so I can disable the WOL option...

    Image: https://docs.google.com/file/d/0Bwt5RXKVpANgaXJIRzZOdWFUUUE/edit?usp=sharing



  • 5.  RE: Some computers doing UNWANTED Wake-On-Lan

    Posted Aug 06, 2013 05:01 AM

    We found the policy where the option was turned on... As mentioned in your first reply the computers booting up are not in the filter of the policy, which makes it extra weird. I disabled the option to wake up the computers in the policy and I'm sure everything will be fine now. 

     

    For those interested, this is the query I used to find the name of the policy:

     

    SELECT DISTINCT pol.Name AS [Policy], pol.[guid], pol.Attributes
            ,package.[Package Location]
            ,package.ProgramName AS [Commandline Type]
            ,package.CommandLine
            ,detrule.Name AS [Detection Rule]
            ,CAST(detrule.InventoryRuleXml AS NVARCHAR(MAX)) AS [Detection Rule Detail]
            ,tar.Name as [Resource Target]
       FROM vNonResourceItem pol
       LEFT JOIN  vResourceTargetUses rtu
          ON rtu.ItemGuid = pol.Guid
       LEFT JOIN vNonResourceItem tar
          ON tar.Guid = rtu.ResourceTargetGuid
       LEFT JOIN (SELECT pack.PackageId, pack.[Package Location], ir.ParentItemGuid, prog.Name AS ProgramName, prog.CommandLine 
                  FROM ItemReference ir
                  JOIN SWDPackage pack
                     ON pack.PackageId = ChildItemGuid
                     AND _Latest = 1
                  LEFT JOIN SWDProgram prog
                     ON prog.PackageId = pack.PackageId) package
          ON pol.Guid = package.ParentItemGuid
       LEFT JOIN (SELECT ir.ParentItemGuid AS PolicyGuid, iri.Name, irule.InventoryRuleXml
                  FROM ResourceAssociation ra
                  JOIN ItemReference ir
                     on ir.ChildItemGuid = ra.ParentResourceGuid
                  JOIN vRM_Inventory_Rule_Item iri
                     ON iri.Guid = ra.ChildResourceGuid
                  JOIN Inv_Inventory_Rule irule
                     ON irule._ResourceGuid = iri.Guid
                  WHERE ra.ResourceAssociationTypeGuid = '6CCB60F8-E88D-4BA2-959F-4B531C8C5FCD') detrule
          ON detrule.PolicyGuid = pol.Guid
                 
       WHERE pol.ClassGuid IN ('2D3A170E-5028-4570-BA0C-3DB775CB8BDE','212E1D10-4905-4CDB-A90A-81AE77E9DE9A')
       and pol.guid = '13f87bbf-cc0d-4410-8b71-c9bc40597c7e' --insert your guid here