Endpoint Protection

Hi,
we have a Windows Server 2008 R2 with Symantec Endpoint Protection Manager 14.0.1904.0000. The SEPM
is istalled on our server, not in the cloud. This server also has the Symantec Endpoint Protection
client, version 14.0.1904.0000. The server is also a DC in our 2008 R2 Windows domain (domain
functional level: server 2008 R2, forest functional level: server 2008 R2).

We have a 12 seat license. We have 2 servers and 9 workstations. The workstations are Windows 7.
They all have the Symantec Endpoint Protection client, version 14.0.1904.0000.

Recently we replaced two workstations with two new Windows 10 Pro machines. Both are Win 10 version 1709,
(Fall Creators Update). They have hostnames EllPC and UnnPC. I tried to export a client from
SEPM and install on these machines, but it would not install. Then I read this

Windows compatibility with the Endpoint Protection client
https://support.symantec.com/en_US/article.TECH235706.html

and this

Endpoint Protection support for Windows 10 updates and Windows Server 2016
https://support.symantec.com/en_US/article.TECH235458.html
and downloaded the client according to:
https://support.symantec.com/en_US/article.TECH103088.html

I downloaded the most recent client from Symantec and it installed fine on both machines. It was
SEP version 14.0.3752.1000 (14 RU1). I did Export Communication Settings from SEPM and read the resulting file
into SEP on both macines. Worked fine.

Problem is that in SEPM, Clients window, only one of the two new machines appear. Sometimes it is Ell,
othertimes it is Unn. But both machines never appear at the same time. If I go out to the client
machines, and in SEP do Help-Troubleshooting-Management, I can see that sometimes is Server: Offline.
Othertimes the Server is correct. The green dot in the taskbar sometimes is there, sometimes not.
It seems like the server can only communicate with one Win10 client at a time. Or alternatively can only comprehend one Win10-license at a time. Is this so? Why? How do
I fix it? We never have this problem with the Win7 clients.

Grateful for suggestions.

Enable sylink logging on the affected client and let it run through a few heartbeats. Post the log here for review.

See here:

http://www.symantec.com/docs/TECH104758

Hello,

It's not a Licencing issue at all.

There is a communication issue. As suggested above by Brian, please enable the sylink logging which would collect the sylink logs and let us know if the root cause of the issue.

Is there a router / firewall installed on the network? Since you have a small network, are these machines in the local lan?

Hope that helps!!

All machines are in the local LAN. There is a modem/router/firewall (all in one box) at the periphery of the LAN, which connects us to the internet. There is also an unmanaged switch. So it is a very simple network for a small business. No VLAN. I will be back with the sylink thing as soon as possible.

Was one machine cloned from the other?

Sounds like the computers were cloned without removing the SEP UUID so they appears to SEPM as the same SEP client, when one client checks in, it has one system name and when the other client check in it overwrites previous entry and changes name on the SEPM again, the best way to fix issue is to download the repair tool in below symantec link (Download Files > RepairClonedImage.zip) and run and repair on the clients.

https://support.symantec.com/en_US/article.TECH163349.html

Denliu is correct.  This is a duplicate Hardware ID issue.  To correct, please follow these steps on one of the clients.

1. Stop SMC using the "smc -stop" command. (Start > Run > "smc -stop" > Select OK)
2. Empty the HardwareID registry value under HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink to blank.
3. Delete or rename C:\ProgramData\Symantec\Symantec Endpoint Protection\PersistedData\sephwid.xml
4. Start SMC using the "smc -start" command. (Start > Run > "smc -start" > Select OK)

This should get them both showing up in the SEPM. 

If you are cloning these Win 10 systems please make sure to follow Denliu's steps and run the RepairClonedImage.zip on the Gold Image before sending it out to any more systems.

Thanks,
John

This is probably correct. The machines were cloned. This network is located at a client of mine. They have a junior computer guy that makes and sets up new machines, and he told me briefly that he cloned the machines.

I asked the client in an email earlier today to go back there and fix the problem, so now I am waiting for a response. Will follow up as soon as they reply (communication is unfortunately not their greatest skill).

Thanks again. This was awesome!

Great to hear Peder.  Please mark a solution once you have verified it fixed the issue!
 

Thanks a lot for helping out. I marked JBotsford as the solution because he was the first to hint about the cloning. Again - thanks everybody, this was very helpful.