Endpoint Protection

 View Only
Expand all | Collapse all

Managed client no longer appears in console

Migration User

Migration UserJan 08, 2010 11:04 PM

  • 1.  Managed client no longer appears in console

    Posted Jan 08, 2010 08:46 PM
    I upgraded to SEP 11.0.5002.333 on my desktop client last month. Today I noticed this client no longer appears in the management console in any of the groups, even though it is a managed client and the green circle is showing on the shield icon. The server name and group appear correctly in the client Troubleshooting window. THE SEP client is installed on a Vista Ultimate (SP1) 32-BIT machine and the SEP server is also at 11.0.5.

    Finding unmanaged computers in the console for this IP address returns nothing.

    I am not running any firewall on the client machine, not Windows or SEP.

    I've since installed or upgraded the client on several other machines, including Vista-64 BIT, XP, and Windows 7 and they all show up in the console as expected.

    Has anyone else seen this behavior?


  • 2.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 09:15 PM
    I'm in the same boat. BUT only when I install an unmanaged client then make it managed by replacing the sylink.xml file. The client has the green dot but is nowhere to be found in SEPM. It receives updates and acts normal as far as I can tell. The only thing that works is if I uninstall SEP completely then deploy from the SEMP console it appears in SEPM as it should.


  • 3.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 10:26 PM
    It's been a month, but I'm pretty sure that's how I did this install also. My client also looks completely normal and gets updates and everything - just doesn't show up in the console.  Isn't dropping the sylink.xml file a supported method of converting from unmanaged to managed?


  • 4.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 10:43 PM
    Hi.. I hope this will be little help to you...


    You can search the client in the SEPM DATABASE. This is a long process but you will find out whether the client is present in the database.

    Get the ComputerID and HardwareID under following key...
    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink

    Use this SQL to get the details of the client in the MS Database
    ___________________________________________________________________
    SELECT [CLIENT_ID]
    ,[DOMAIN_ID]
    ,[GROUP_ID]
    ,[POLICY_MODE]
    ,[COMPUTER_ID]
    ,[HARDWARE_KEY]
    FROM [sem5].[dbo].[SEM_CLIENT] where [HARDWARE_KEY] = 'put HardwareID from
    above reg key'
    ___________________________________________________________________

    Then get Group name using this SQL.

    SELECT [ID]
    ,[NAME]
    ,[TYPE]
    ,[DOMAIN_ID]
    FROM [sem5].[dbo].[IDENTITY_MAP] where [ID] = 'GROUP_ID from above SQL'

    Now you will be able to see to which group the client are pointing to
    ____________________________________________________
    If you want to move the client you can use this SQL

    Get the Group ID of known group from [sem5].[dbo].[IDENTITY_MAP] table.
    use this sql to move the client which is not appearing in the console to the known group.

    UPDATE [sem5].[dbo].[SEM_CLIENT]
    SET [GROUP_ID] = 'New group ID'
    WHERE [CLIENT_ID] = 'Mising Pc CLIENT_ID'

    Now the client will show under the group you have specified.
     


  • 5.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 10:57 PM

    Can anyone help me with this error?


    Problem Event Name: APPCRASH

    Application Name: Rtvscan.exe

    Application Version: 10.2.0.276

    Application Timestamp: 456c440b

    Fault Module Name: kernel32.dll

    Fault Module Version: 6.0.6000.21010

    Fault Module Timestamp: 49951e1e

    Exception Code: c0000005

    Exception Offset: 00048dc6

    OS Version: 6.0.6000.2.0.0.768.2

    Locale ID: 1033

    Additional Information 1: ca97

    Additional Information 2: d98662dc20f7d53ae3f01bb889ecf5a4

    Additional Information 3: cce4

    Additional Information 4: ea5f1bb509488291ce9493ff00eceb50



  • 6.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 11:04 PM
    Repair SEP and try...


  • 7.  RE: Managed client no longer appears in console

    Posted Jan 08, 2010 11:56 PM
    If the client has a green dot then it should be definitely reportin to the console; Did you check for multiple domains?? ... Also, did you search for that computer in both user mode and computer mode?... You can alternatively drop a sylink file from default group and then bring it back to its appropriate group (if it showsup) ...

    Cheers,
    Visu.


  • 8.  RE: Managed client no longer appears in console

    Posted Jan 10, 2010 04:47 PM
     Hi Rosetta,

    You need to make a new post on your issue. Tagging onto someone else's post is confusing for everyone involved, and makes it much harder for us to answer either one of your questions. 

    Thanks,
    Grant


  • 9.  RE: Managed client no longer appears in console

    Posted Jan 10, 2010 05:09 PM
    Symantec Endpoint Protection: Troubleshooting Client/Server Connectivity
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008091215040048

    I suggest you try the article above. Also is this happening on only one client? And are you sure the client showed prior to the upgrade to RU5? I say this because sometimes the reason a client won't show up in the console is that it has the same MAC address as another piece of hardware in your environment. Everything that you have said about your issue points to this. So have you recently added more computers to your environment? Maybe around the same time as the upgrade to RU5. If that is the case maybe one of these computers has the same MAC address and is overriding the other client. To test my threory please change the MAC address of the client that is not showing up (make sure it is unique) and see if that solves the issue. A google search should provide you with many guides on changing the MAC address, but if you have trouble feel free to post back.

    Thanks
    Grant




  • 10.  RE: Managed client no longer appears in console

    Posted Jan 11, 2010 10:29 AM
    We see this happening most with Windows 7 clients and RU5.
    The Win7 boxes are getting updated fine, they show a green dot, but dont appear on the console.


  • 11.  RE: Managed client no longer appears in console

    Posted Jan 11, 2010 07:14 PM

    shp,

    Thank you for the query - it confirmed this client is present in the database. However, I won't use your 2nd statement to modify the sep5 database - I would only do that base on explicit instructions from a Symantec employee. 



  • 12.  RE: Managed client no longer appears in console

    Posted Jan 11, 2010 07:18 PM
    Visu310,

    I do have multiple domains, but Help & Support --> Troubleshooting Server and Group fields on the client do not indicate anything other than the default domain for the group listed. Would a different domain show up there?

    I was using Find Unmanaged Computers, but I tried Search instead as you suggested and the client was found in the search window, but it still does not come up in the Clients list.


  • 13.  RE: Managed client no longer appears in console

    Posted Jan 11, 2010 07:42 PM

    Grant,

    I looked at the article - it is quite extensive. My client is communicating with the server - it has the green circle. I can also ping and I am even running the management console on this client machine. So communications is not the issue.

    I don't know if other clients have the problem or not, but I suspect they do. When comparing the policy number as suggested in the article you linked, the policy numbers match exactly, but in the Details tab on the console, it indicates # of physical computers: 33  and # of registered users:  28 -- and I count only 30 computers in the client list. Does that answer the question? I'm not sure, but I would suspect the # of users should always be >= # of computers.

    Even though the policy numbers matched and I am receiving updates, I issued an update command anyway.  That didn't change anything. One weird thing is the server name in troubleshooting lists the IP address and not the name of the server as it appears on other clients.

    Also instead of modifying my mac address as you suggested, I issued the query Select computer_id, domain_id, hardware_key from sem5.dbo.[sem_computer] where mac_addr1 = '(my mac address)' and it came back with only one record, with the computer_id and hardware_key matching the same from the client registry identically, so I would conclude there is not another computer with a duplicate mac address out there.

    This client did show up in the console when it was an 11.0.4 client, but contrary to what I stated above, after I did the install, I did not use a sylink file to become managed. (I can tell from event log exactly when I installed the client, but I have no sylink file with an access date after this.) So could this mix-up have happened by not explictly removing this client from the console before I did an over-install?

     



  • 14.  RE: Managed client no longer appears in console
    Best Answer

    Posted Jan 11, 2010 11:32 PM
    Go to one problematic client.
    In GUI go to help and support---->troubleshooting
    Note the  group name and server ip.
      Come to this server go to Clients-------> <noted group>---->clients(right side). You will be able to see one next page button in the top. Click on it and see whether the client is appearing there
    OR
    in left side(after going to Clients-------><noted group>---->clients(right side)) you will see one option as set display filter click on it and increase the value 
     


  • 15.  RE: Managed client no longer appears in console

    Posted Jan 12, 2010 06:11 AM

    Hey thanks for trying out our suggestions dude.. Well, since you have confirmed that the client does not have duplicate entry in the DB, the HWID conflict is ruled out... And if am not mistaken, you said that the client is listed when you do a 'Search' on the group, right?

    * Is it listed with a green dot?
    * Is it listed as computer mode or user mode?

    * Check the filter options of the group, under tasks. Cos, it has an option to display only computer or users... May be that's giving us a headache...?

    Apart from that, you said that you have multiple domains.... So open the Sylink.xml on the Win7 pc and check the domainID ( which is present on te top).... compare it with the domain ID in SEPM.. under Admin-> Domains... Alternatively, you can compare this with another client's sylink.\xml who is already showing up in the client's tab of console...


    Cheers,
    Visu



  • 16.  RE: Managed client no longer appears in console

    Posted Jan 12, 2010 06:25 PM
     Still doing more searching on this issue. Ran across one other article that might help:

    Symantec Endpoint Protection clients do not appear in the Management console, but are being updated and the shield icon shows a green dot.
    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111510031148

    Thanks
    Grant



  • 17.  RE: Managed client no longer appears in console

    Posted Jan 12, 2010 08:29 PM

    AravindKM, I never realized there was a next page button, because I had a scroll bar appearing and I was scrolling up and down to see what I thought were all the clients. This also solves the question of why the physical number was different from what I saw. I can't believe it was something so simple and IN MY FACE the whole time!  Thank you so much everybody for taking the time to offfer troubleshooting suggestions.

    The Set Display Filter is something I hadn't looked at before, or I forgot was there, but it does the trick! Thanks, AravindKM



  • 18.  RE: Managed client no longer appears in console

    Posted Jan 12, 2010 08:47 PM
    I want to stress the Set Display Filter that was mentioned above. When my clients were displayed across multiple screens (pages), and I sorted by IP address so I could find a specific client, the IP address did not show up. Only the clients on that screen were sorted. So changing the filter display is a way to see all at once and get the rest into the sort. Thanks again, everyone for the time you spent on this.


  • 19.  RE: Managed client no longer appears in console

    Posted Jan 12, 2010 11:21 PM
    Ok .it happens.many times we will miss very silly things which will be very important.This is common with human.Any way happy to hear your problem got solved.