Endpoint Protection

I have been having this probem for some time. This client no longer on network but SEPM is still saying "Computer Detected without Symantec Client Software"

Where does the SEPM get this information? I've checked Active Directory users and computers, DNS, DHCP am I missing someplace?

Where you are getting this message? 

Are you talking about the unmanaged detector or find unmanaged computers??.. In both cases, DNS cache plays a role.... both zones needs to be reset... and just in case, if you have this problem with reports.. am afraid thats a product bug.. sometimes deleted clients stay in the database and we will have to manually delete it..

Cheers,
Visu.

I have the unmanaged detector routinely send out messages if there are systems on our network that do not have SEP on them. There are systems we have that do not need SEP so I exempted those particular IPs but there is one system/client in particular with hostname and IP that was removed but SEPM still sees it.

When you say both zones need to be reset do you mean reload or clear cache?

Is removing a client that stays in the database something that I could do?

try anikets suggestion to remove duplicate entry from DB
https://www-secure.symantec.com/connect/forums/sep-and-ad

Its enough to clear the cache... and yes you can manipulate the database table to get this fixed.. Sorry but I am still not getting a clear idea... Is SEPM detecting a client machine that is NO more in the network? or is SEPM detecting a client machine that has just been removed from SEPM? .. If you could just give us a bit more info, that'd be great .. :)

Cheers,
Visu.

Try by clearing ARP cache in the unmanaged detector client computer .For this do as follows
Click on Start—>Run—> type the following command click ok

netsh interface ip delete arpcache
 
After this assure that no  entry of problematic client  is  present in ARP table  using following command
arp -a

I checked the arp table and there was no indication of the client. I did check WINS though and the client was in there as active. I did remove the client from there. Does SEPM use WINS?

I did try anikets suggestion to remove duplicate entry from DB
https://www-secure.symantec.com/connect/forums/sep-and-ad 

Thanks. I wait till the next notification comes around.

Yes, SEPM uses WINS, AFAIK.... And now that you have cleared the table, I suppose things should work fine... If you want to clear the information from the "Security status", you can quickly flush that information.

That information is available in a table called LAN_DEVICE_DETECTED in the database, you can just clear the rows of this table and unmanaged detector will again populate the information... :) ..

Cheers,
Visu.

Thanks all.

Just a few more questions. Accessing the database. This isn't a SQL Server Dbase correct? How is it accessed?

This one is strange. SEPM is detecting a non routable IP, 192.168.100.100 it's likely a newly imaged system here probably couldn't find our DHCP server so created an IP for itself, I cannot find this system anywhere and it's likely no longer on the network. It would be nice if SEPM would update this once that happens. Hopefully clear the dbase will fix that.

1. Navigate to SEPM\ASA\Win32 and run dbisqlc.exe

2. That will give you a window similar to ODBC config.

3. Provide all the needed information:

Username : DBA
password: password of admin account you chose during install.

source : Symantec DSN

* In the Database tab, provide the server name(if its RU5, you have to preceeed the server's hostname by SPC_ )

* Database name is 'Sem5'

* And for database file, browse and choose sem5.db under SEPM\db\sem5.db
( Care should be taken to point to right sem5.db.... as there will be another sem5.db under asa folder)

* Click on Okay

4. If the information given are correct, it will open up a Interactive SQL.

5. In the execute window, type the query

SELECT * FROM LAN_DEVICE_DETECTED

This will get you the list of findings by the Unmanaged detector, look for the affectec client and you can delete it, by delete command.

Also, with the same client name, you can check in the tables SEM_AGENT, SEM_COMPUTER and SEM_CLIENT.

Let me know how it goes :)

 

Thanks all and Visu310 for the db instructions. I ran the LAN_DEVICE _DETECTED command and got the list but the IP's  look like they need to be deciphered. I can't tell what they are just by looking at them.

Thanks all and Visu310 for the db instructions but there is a problem reading the IP Addresses.


I ran the LAN_DEVICE _DETECTED command and got the list but the IP's  look like they need to be deciphered. I can't tell what they are just by looking at them.

I have accumulated a few more addresses since the beginning of this post even after AD has been cleaned up and it's becomming quite frustrating .