Endpoint Protection

Hi All,
we have delpoyed a failry large SEP 11 delpoyment and what we are finding is that some of the SEP clients are registering twice with SEPM.  Is their a query that can be run on the database to find the hosts that have registered twice in the database??
Thanks

There is no option in SEPM to run a database query from SEPM.
You can query the database. But unfortuntly Symantec Doesnot support that.


You can download Symantec™ Endpoint Protection Manager Database Schema Reference

ftp://ftp.symantec.com/public/english_us_canada/products/symantec_endpoint_protection/11.0/manuals/mr2/schema_reference_guide.pdf

There is a way to remove duplicate ROWS form a particular TABLE in SQL if you can identify the Table.

Else, you'd need to go ahead and delete ALL the clients from the SEPM / SQL DB, and wait till they register again at the default heartbeat interval that has been set for them.

HTH

You could try the following.

I'd suggest that you make a copy of the SEPM DB to another new DB in the SQL Server instance, and try the query(ies) on the copy. NOT THE ORIGINAL DB.

To check that you have duplicate records in your table do the following:

select count(*) from TableName

and

select distinct * from TableName

You have duplicate records if the number of records returned by the second query, is less than the number of records returned by the first.
you can do is to copy all the distinct records into a new table:

select distinct *
into DuplicateTable
from TableName

This query will create a new table (DuplicateTable) containing all the records in the original table but without any records being duplicated. It will  preserve a single copy of those records which were duplicated.

This will only help you to identlfy the Duplicate Entries in the DB.

In order to delete the duplicates effectively, you'll need to run the following query:

delete * from table_name

This query will effectively remove all the entries in the specific identified table. Ideally in this scenario, the table name will be something like "clientname" or "client name". Be sure to lookup the table thru the SQL Explorer / SQL Server Management Tools before you run the query with the designated table name.

HTH.

Thanks