Endpoint Protection

I'm having alot of strange issues in the past few weeks.  I recently upgraded the SEPM to RU5, however as far as I can tell these issues started before that upgrade.  The clients are all still running earlier versions.  I've had a case open with Symantec for a week and a half now with almost no results.  I know everyone here can help me more than tech support has.

I'll list a few of the symptoms here to see if anyone else is having similar issues.  I'm wondering if all or some of these issues are related to secars.  I recently realized that the secars test is failing no matter where I try it, including the SEPM.  The majority...probably 95% of clients are perfectly happy - with no issues at all. 

Symptoms:

1. Clients completely stopping connections to the SEPM.  Last check in, weeks ago.  SMC logs don't show any obvious problem.
2. Clients showing green dot - SEPM showing no green dot.  Last check in time - very recent.  Some of these clients get def updates, some do not.

If this is related to the secars problem, what kind of things can I do to troubleshoot.  I have turned on logging in IIS for secars.  I see GET's but no POST's in the logs.  Any help at all would be appreciated.  Thanks.

Check your IIS logs you wil see lot of 401 erros , reset the passoword for IIS and it should work

Clients stop communicating with Symantec Endpoint Protection Manager (SEPM) with HTTP 401 error in Sylink log and HTTP 401.1 error in IIS log

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008032702341648

after resetting the sylink test secars you should get OK

You might also want to check for Duplicate Client Entries in the DB:

https://www-secure.symantec.com/connect/articles/hardware-change-causes-re-registration-which-generates-multiple-entries-sepm-database


Thanks :-)

Hi,

You mentioned that the secars test fails. Could you also mention the HTTP error you are getting. And make sure that you are using this article for the secars test.

To test connectivity from a client to the Symantec Endpoint Protection Manager (SEPM), type the following URL In a web browser:

http://<SEPM_Server_IP_or_Machine_Name:Port>/secars?hello,secars

Example: http://10.0.2.2:8014/secars?hello,secars

A successful connection returns a web page that displays "OK."
Troubleshoot any other message appropriately.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007101711140148


Also, you can use the article for troubleshooting communication:

https://www-secure.symantec.com/connect/articles/troubleshooting-client-commuincation


Aniket

We have the opposite. Clients all connect just fine - but the SECARS test fails everywhere! No ok, no nothing.
But clients are all current, check-in times are fine, and those that are NOT current in the SEM can be explained by the computer being turned off, asleep, etc. But no matter what computer I try it on, SECARS fails the test above!
That being said, I wonder how reliable a test that is if the TEST can fail but the CLIENTS work just fine?

Thanks...I'm going to check on all of these things and report back.  ShadowsPapa, I'm not sure how clear I made it but that is the same situation here.  All of the clients that are %100 fine (check in time, virus defs, etc.) also fail the secars test.  Another thing I didn't mention is that a bunch of the client which have recent check in times, no green dot, and out of date virus defs, are still showing the previous policy.  So they're "checking in" quickly but not doing anything else.... i.e. policy updates, virus def updates.

you may need to run the sylinkmonitor and paste the results when you have manually clicked on the client gui for update policy.

https://www-secure.symantec.com/connect/articles/how-capture-sep-sepm-communication-logs-sylinkmonitor-mr3-onwards-troubleshooting-communica

Secars test is working now.  I'm still having these weird issues.  Here is the sylink log from a problem client.  One thing I want to mention is that some of the problem clients are in an area of the network which will be unable resolve the host name but in my understanding, should also be attempting to use the IP address.  Some clients in this area of the network are working fine, others are not.  So I don't think this is related...I'm only mentioning it in case the sylink log reflects this.

Here is the sylink log.  If anyone has any suggestions at all, please let me know.

10/23 14:41:56 [3776] <ParseErrorCode:>12029=>The attempt to connect to the server failed.
10/23 14:41:56 [3776] <SendRegistrationRequest:>SMS return=0
10/23 14:41:56 [3776] <ParseHTTPStatusCode:>0=>Uninterpreted Status
10/23 14:41:56 [3776] <SendRegistrationRequest:>ERR to query content length
10/23 14:41:56 [3776] <SendRegistrationRequest:>Content Lenght =>
10/23 14:41:56 [3776] HTTP returns status code=0
10/23 14:41:56 [3776] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
10/23 14:41:56 [3776] <SendRegistrationRequest:>COMPLETED
10/23 14:41:56 [3776] HEARTBEAT: Check Point 5.1
10/23 14:41:56 [3776] <RegHeartbeatProc>switch to another server
10/23 14:41:56 [3776] HEARTBEAT: Check Point 9
10/23 14:41:56 [3776] HEARTBEAT: Check Point 8
10/23 14:41:56 [3776] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
10/23 14:41:56 [3776] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
10/23 14:41:56 [3776] HEARTBEAT: Check Point 1
10/23 14:41:56 [3776] HEARTBEAT: Check Point 2
10/23 14:41:56 [3776] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
10/23 14:41:56 [3776] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
10/23 14:41:56 [3776] HEARTBEAT: Check Point 3
10/23 14:41:57 [3776] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
10/23 14:41:57 [3776] HEARTBEAT: Check Point 4
10/23 14:41:57 [3776] <RegHeartbeatProc>===Registration STAGE===
10/23 14:41:57 [3776] <MakeRegisterData:>logon id (domain/user)=LocalComputer/lsadmin

read error, exit
10/23 14:42:04 [3776] <ParseErrorCode:>12007=>The Server name could not be resolved.
10/23 14:42:04 [3776] <SendRegistrationRequest:>SMS return=0
10/23 14:42:04 [3776] <ParseHTTPStatusCode:>0=>Uninterpreted Status
10/23 14:42:04 [3776] <SendRegistrationRequest:>ERR to query content length
10/23 14:42:04 [3776] <SendRegistrationRequest:>Content Lenght =>
10/23 14:42:04 [3776] HTTP returns status code=0
10/23 14:42:04 [3776] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
10/23 14:42:04 [3776] <SendRegistrationRequest:>COMPLETED
10/23 14:42:04 [3776] HEARTBEAT: Check Point 5.1
10/23 14:42:04 [3776] <ScheduleNextUpdate>new scheduled heartbeat=32 seconds
10/23 14:42:04 [3776] HEARTBEAT: Check Point 8
10/23 14:42:04 [3776] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
10/23 14:42:04 [3776] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
10/23 14:42:04 [3776] <RegHeartbeatProc>====== Registration Procedure stops at 14:42:04 ======
10/23 14:42:04 [3776] HEARTBEAT: Check Point 10
10/23 14:42:04 [3776] HEARTBEAT: Check Point Complete
10/23 14:42:04 [3776] <RegHeartbeatProc>Done, Heartbeat=32seconds
10/23 14:42:04 [3776] HeartbeatProcFailed to get profile with proxy setting 1
10/23 14:42:04 [3776] <CheckHeartbeatTimer>====== Heartbeat loop stops at 14:42:04 ======
10/23 14:42:28 [5060] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds
10/23 14:42:28 [3776] <CheckHeartbeatTimer>====== Heartbeat loop starts at 14:42:28 ======
10/23 14:42:29 [3776] <GetOnlineNicInfo>:Netport Count=2
10/23 14:42:29 [3776] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="172.17.4.54" Mac="00-21-5e-c7-54-1c" Gateway="172.17.4.1" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.119" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.120" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs>
10/23 14:42:29 [3776] <CalcAgentHashKey>:CH=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:29 [3776] <CalcAgentHashKey>:CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:29 [3776] <CalcAgentHashKey>:C=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.com
10/23 14:42:29 [3776] <CalcAgentHashKey>:CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:29 [3776] <CalcAgentHashKey>:UCH=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:29 [3776] <CalcAgentHashKey>:UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:29 [3776] <CalcAgentHashKey>:UC=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.com
10/23 14:42:29 [3776] <CalcAgentHashKey>:UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:29 [3776] <DoHeartbeat>HardwareID=B6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:29 [3776] <DoHeartbeat>CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:29 [3776] <DoHeartbeat>CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:29 [3776] <DoHeartbeat>UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:29 [3776] <DoHeartbeat>UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:29 [3776] <DoHeartbeat> Set heartbeat event
10/23 14:42:29 [3776] Use new configuration
10/23 14:42:29 [3776] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 14:42:29 ======
10/23 14:42:30 [3776] HEARTBEAT: Check Point 1
10/23 14:42:30 [3776] HEARTBEAT: Check Point 2
10/23 14:42:30 [3776] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
10/23 14:42:30 [3776] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
10/23 14:42:30 [3776] HEARTBEAT: Check Point 3
10/23 14:42:30 [3776] mfn_CreateInetSession: Session is NULL for users's proxy setting .. Communication id bound to FAIL..
10/23 14:42:30 [3776] Throw Internet Exception, Error Code=0;AH: failed to open internet.
10/23 14:42:30 [3776] CInternetException: <RegHeartbeatProc>: The operation completed successfully.

10/23 14:42:30 [3776] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds
10/23 14:42:30 [3776] <RegHeartbeatProc>====== Registration Procedure stops at 14:42:30 ======
10/23 14:42:30 [3776] HEARTBEAT: Check Point 10
10/23 14:42:31 [3776] HEARTBEAT: Check Point Complete
10/23 14:42:31 [3776] <RegHeartbeatProc>Done, Heartbeat=1seconds
10/23 14:42:31 [3776] HeartbeatProcFailed to get profile with proxy setting 2
10/23 14:42:31 [3776] <CheckHeartbeatTimer>====== Heartbeat loop stops at 14:42:31 ======
10/23 14:42:32 [3776] <CheckHeartbeatTimer>====== Heartbeat loop starts at 14:42:32 ======
10/23 14:42:32 [3776] <GetOnlineNicInfo>:Netport Count=2
10/23 14:42:32 [3776] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="172.17.4.54" Mac="00-21-5e-c7-54-1c" Gateway="172.17.4.1" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.119" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.120" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs>
10/23 14:42:32 [3776] <CalcAgentHashKey>:CH=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:32 [3776] <CalcAgentHashKey>:CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:32 [3776] <CalcAgentHashKey>:C=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.com
10/23 14:42:32 [3776] <CalcAgentHashKey>:CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:32 [3776] <CalcAgentHashKey>:UCH=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:32 [3776] <CalcAgentHashKey>:UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:32 [3776] <CalcAgentHashKey>:UC=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.com
10/23 14:42:32 [3776] <CalcAgentHashKey>:UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:32 [3776] <DoHeartbeat>HardwareID=B6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:32 [3776] <DoHeartbeat>CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:32 [3776] <DoHeartbeat>CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:32 [3776] <DoHeartbeat>UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:33 [3776] <DoHeartbeat>UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:33 [3776] <DoHeartbeat> Set heartbeat event
10/23 14:42:33 [3776] Use new configuration
10/23 14:42:33 [3776] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 14:42:33 ======
10/23 14:42:33 [3776] HEARTBEAT: Check Point 1
10/23 14:42:33 [3776] HEARTBEAT: Check Point 2
10/23 14:42:33 [3776] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
10/23 14:42:33 [3776] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
10/23 14:42:33 [3776] HEARTBEAT: Check Point 3
10/23 14:42:33 [3776] mfn_CreateInetSession: Session is NULL for 'no proxy' setting .. Communication id bound to FAIL..
10/23 14:42:33 [3776] Throw Internet Exception, Error Code=0;AH: failed to open internet.
10/23 14:42:33 [3776] CInternetException: <RegHeartbeatProc>: The operation completed successfully.

10/23 14:42:33 [3776] <ScheduleNextUpdate>Manually assigned heartbeat=1 seconds
10/23 14:42:33 [3776] <RegHeartbeatProc>====== Registration Procedure stops at 14:42:33 ======
10/23 14:42:33 [3776] HEARTBEAT: Check Point 10
10/23 14:42:34 [3776] HEARTBEAT: Check Point Complete
10/23 14:42:34 [3776] <RegHeartbeatProc>Done, Heartbeat=1seconds
10/23 14:42:34 [3776] HeartbeatProcFailed to get profile with proxy setting 3
10/23 14:42:34 [3776] <CheckHeartbeatTimer>====== Heartbeat loop stops at 14:42:34 ======
10/23 14:42:35 [3776] <CheckHeartbeatTimer>====== Heartbeat loop starts at 14:42:35 ======
10/23 14:42:35 [3776] <GetOnlineNicInfo>:Netport Count=2
10/23 14:42:35 [3776] <GetOnlineNicInfo>:NicInfo<SSANICs><SSANIC Ip="172.17.4.54" Mac="00-21-5e-c7-54-1c" Gateway="172.17.4.1" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.119" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/><SSANIC Ip="169.254.95.120" Mac="02-21-5e-cb-57-b7" Gateway="0.0.0.0" SubnetMask="0.0.0.0"/></SSANICs>
10/23 14:42:35 [3776] <CalcAgentHashKey>:CH=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:35 [3776] <CalcAgentHashKey>:CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:35 [3776] <CalcAgentHashKey>:C=4A2042C20A01C8A90165EFF60FD27FE11ls322intra.lutron.com
10/23 14:42:35 [3776] <CalcAgentHashKey>:CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:35 [3776] <CalcAgentHashKey>:UCH=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.comB6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:35 [3776] <CalcAgentHashKey>:UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:35 [3776] <CalcAgentHashKey>:UC=4A2042C20A01C8A90165EFF60FD27FE10lsadminLocalComputerls322intra.lutron.com
10/23 14:42:36 [3776] <CalcAgentHashKey>:UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:36 [3776] <DoHeartbeat>HardwareID=B6E9D97B3BB19E20B7E2F9B9D20C828E
10/23 14:42:36 [3776] <DoHeartbeat>CHKey=BAC4C5B0E190AE2CDABE97BE1C3AAC10
10/23 14:42:36 [3776] <DoHeartbeat>CKey=28BF400EC51EE7C6C507CA7868744C46
10/23 14:42:36 [3776] <DoHeartbeat>UCHKey=FEBC0854F57C8391E77DA2096C35D529
10/23 14:42:36 [3776] <DoHeartbeat>UCKey=283333B241345FC696FF329DCAEBBAED
10/23 14:42:36 [3776] <DoHeartbeat> Set heartbeat event
10/23 14:42:36 [3776] Use new configuration
10/23 14:42:36 [3776] <RegHeartbeatProc>====== Reg Heartbeat loop starts at 14:42:36 ======
10/23 14:42:36 [3112] <CSyLink::mfn_DownloadNow()>
10/23 14:42:36 [3112] </CSyLink::mfn_DownloadNow()>
10/23 14:42:36 [3776] HEARTBEAT: Check Point 1
10/23 14:42:36 [3776] HEARTBEAT: Check Point 2
10/23 14:42:36 [3776] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
10/23 14:42:36 [3776] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
10/23 14:42:36 [3776] HEARTBEAT: Check Point 3
10/23 14:42:36 [3776] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
10/23 14:42:36 [3776] HEARTBEAT: Check Point 4
10/23 14:42:36 [3776] <RegHeartbeatProc>===Registration STAGE===
10/23 14:42:36 [3776] <MakeRegisterData:>logon id (domain/user)=LocalComputer/lsadmin

read error, exit
10/23 14:42:57 [3776] <ParseErrorCode:>12029=>The attempt to connect to the server failed.
10/23 14:42:57 [3776] <SendRegistrationRequest:>SMS return=0
10/23 14:42:57 [3776] <ParseHTTPStatusCode:>0=>Uninterpreted Status
10/23 14:42:57 [3776] <SendRegistrationRequest:>ERR to query content length
10/23 14:42:57 [3776] <SendRegistrationRequest:>Content Lenght =>
10/23 14:42:57 [3776] HTTP returns status code=0
10/23 14:42:57 [3776] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
10/23 14:42:57 [3776] <SendRegistrationRequest:>COMPLETED
10/23 14:42:58 [3776] HEARTBEAT: Check Point 5.1
10/23 14:42:58 [3776] <RegHeartbeatProc>switch to another server
10/23 14:42:58 [3776] HEARTBEAT: Check Point 9
10/23 14:42:58 [3776] HEARTBEAT: Check Point 8
10/23 14:42:58 [3776] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
10/23 14:42:58 [3776] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
10/23 14:42:58 [3776] HEARTBEAT: Check Point 1
10/23 14:42:58 [3776] HEARTBEAT: Check Point 2
10/23 14:42:58 [3776] <PostEvent>going to post event=EVENT_SERVER_CONNECTING
10/23 14:42:58 [3776] <PostEvent>done post event=EVENT_SERVER_CONNECTING, return=0
10/23 14:42:58 [3776] HEARTBEAT: Check Point 3
10/23 14:42:58 [3776] <RegHeartbeatProc>Setting the session timeout on Profile Session (Registration) to 30000
10/23 14:42:58 [3776] HEARTBEAT: Check Point 4
10/23 14:42:58 [3776] <RegHeartbeatProc>===Registration STAGE===
10/23 14:42:58 [3776] <MakeRegisterData:>logon id (domain/user)=LocalComputer/lsadmin

read error, exit
10/23 14:43:05 [3776] <ParseErrorCode:>12007=>The Server name could not be resolved.
10/23 14:43:05 [3776] <SendRegistrationRequest:>SMS return=0
10/23 14:43:05 [3776] <ParseHTTPStatusCode:>0=>Uninterpreted Status
10/23 14:43:05 [3776] <SendRegistrationRequest:>ERR to query content length
10/23 14:43:05 [3776] <SendRegistrationRequest:>Content Lenght =>
10/23 14:43:05 [3776] HTTP returns status code=0
10/23 14:43:05 [3776] <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
10/23 14:43:05 [3776] <SendRegistrationRequest:>COMPLETED
10/23 14:43:05 [3776] HEARTBEAT: Check Point 5.1
10/23 14:43:05 [3776] <ScheduleNextUpdate>new scheduled heartbeat=64 seconds
10/23 14:43:05 [3776] HEARTBEAT: Check Point 8
10/23 14:43:05 [3776] <PostEvent>going to post event=EVENT_SERVER_DISCONNECTED
10/23 14:43:05 [3776] <PostEvent>done post event=EVENT_SERVER_DISCONNECTED, return=0
10/23 14:43:05 [3776] <RegHeartbeatProc>====== Registration Procedure stops at 14:43:05 ======
10/23 14:43:05 [3776] HEARTBEAT: Check Point 10
10/23 14:43:06 [3776] HEARTBEAT: Check Point Complete
10/23 14:43:06 [3776] <RegHeartbeatProc>Done, Heartbeat=64seconds
10/23 14:43:06 [3776] HeartbeatProcFailed to get profile with proxy setting 1
10/23 14:43:06 [3776] <CheckHeartbeatTimer>====== Heartbeat loop stops at 14:43:06 ======

I agree that it would try to communicate first with IP and then hostname
however if you are not able to resolve the name it never gonna communicate.
you need to get your DNS settings set, do  a nslook up if it resolves , then you should have a green dot.

Why would it not communicate using the IP Address?  I know that it's possible because there are many other clients in this exact same area of the network (can't use dns - extranet) which are working perfectly fine.  Thanks

can you tell me whats the value of GlobalUserOffline under this key, check the value of these keys with one working client and non working client.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet
Settings

I don't see it under '.DEFAULT'.  Should this exist in '.DEFAULT'?  I only see it under 'HKEY_CURRENT_USER'.  On a working machine it's showing 0.  I'll check a broken machine under 'HKEY_CURRENT_USER' now.... I know it doesn't exist under '.DEFAULT' on the broken machine either, I've checked it previously.  What exactly is this key used for?  I see it mentioned all the time.  Thanks

I also now have one client which is happy on the client side and completely invisible to me on the SEPM....only thing that exists is an empty placeholder waiting in an OU.  Ever seen that?