Endpoint Protection

 View Only
  • 1.  Clients in wrong group in SEPM and cannot be moved

    Posted Jan 24, 2010 07:00 AM
    I have some clients showing in SEPM in the wrong group. When I go to move them to the correct group, I get an error telling me that they cannot be moved. I'm synched with AD so I'm sure that could be the beginning of the issue but just curious as to why they don't show up correctly in the first place? Any ideas?


  • 2.  RE: Clients in wrong group in SEPM and cannot be moved
    Best Answer

    Posted Jan 24, 2010 09:50 AM
    Please read this (written by Pete Sutsos):
    "

    Here's what I found works with computers in SEPM's Active Directory OU's:  You must move the computer out of the entire OU scope, sync, move it back into the OU, sync again, and the computer now has a "new" object of the same name in the SEPM database.  You then syslink drop it.

    Steps:

    1) SEPM Console: Delete the computer from your Group if possible.  If the computer is in an OU, you can not delete it.  You then have to move it.

    2) Although you cannot add/change/remove computers from the OU's using the SEPM Console, you can with the "Active Directory Users and Computers."  Move (do not delete) the computer into an OU not in SEPM Console scope (this is temporary step in AD.  You're not deleting the AD computer object, just moving it back and forth so SEPM picks it up).

    3) SEPM Console: sync now the OU's (the computer will dissapear in SEPM under your OU's because it's not there anymore, you moved it in step #2.  Note: if you have more than 1 domain controller, you may have to wait for replication before the SEPM server notices the move).

    4) Active Directory Users and Computers: move computer back into your OU scoped in SEPM.  Wait for replication if needed

    5) SEPM Console: sync now the OU's again (it now should show up new in SEPM clients)

    6) SEPM Console: Make NEW syslink.xml file for the OU.  You will use this in the next step.

    7) Client: syslink drop your computer with the new syslink.xml file.  You should get a green dot in the console and client.

    Works every time.  You may see the older computer by the same name show up in database, not checking in and it will take its sweet time to fall off.  That's a whole different problem well documented here."

    it was posted here:
    https://www-secure.symantec.com/connect/forums/move-client-group-active-directory

    another this you might want to read:

    https://www-secure.symantec.com/connect/forums/ad-integration-sep-groups-computers-moving-themselves-around

    and:

    Organizational Units from Active Directory in Symantec Endpoint Protection 11.0

     

    Regards,
    Naor Penso



  • 3.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Jan 24, 2010 10:32 AM
    Thanks, I will try this and update


  • 4.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Jan 24, 2010 11:22 AM
    Worked like a charm. Thanks for pointing me in the right direction!


  • 5.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 10, 2010 06:56 AM
    You, my dear boy, are a legend. Our SEPM OU structure has never looked so good :)


  • 6.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 11, 2010 03:37 PM

    I have this problem and it's affecting 700 clients so far (from 32.000) but we cannot temporary move or delete wrong-group-clients on the Active Directory. It's company rules. So the only solution I have is delete the entire domain and import it again, but we loose all the policies on the process. Since we have almost 200 specific policies applied to down-level specific groups this is not an option.

    A proactive solution would be save the Hardware (it's stored at HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\HardwareID) before formatting the client and then restore it when you see the problem.

    But it does not solves the problem.

    I'm still waiting for a solution on this. Maybe on the next release....



  • 7.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 11, 2010 07:35 PM
    Have you tried deleting the group in SEPM and re-importing?

    I had the same issue and just deleted and re-imported and the clients moved to the correct groups in SEPM.


  • 8.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 12, 2010 06:48 AM

    You cannot delete Active Directory imported subgroups or OU's. Only the whole domain can be deleted.



  • 9.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 12, 2010 07:28 AM
    This is why I create my own groups in SEPM. I have groups broken down by location and departments.



  • 10.  RE: Clients in wrong group in SEPM and cannot be moved

    Posted Mar 12, 2010 11:17 AM
    I have no problem deleting an AD imported group in SEPM. I suppose because I create groups then import. I do it all the time to get clients into the correct groups.