cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Machine and User accounts are getting automatically wiped from EEM.

Hi,

I have recently done OS migration of EEM/EEPC from 2003 32bit to 2008 32bit. Migration was successfully but after 5 days i had been reported with an issue with Error [db010010]: Object not found on client machine. i checked machine id on database but it was black in EEM. I checked machine in all groups, orphaned objects an in deleted machines but machine was not existed.

i again created a new installation pack and installed on some testing machines with new user account. No issue found, but again after 2 days machines ID was not existed in database. And when i checked for user account is was not there too.

I noticed one more weird thing that when i was installing new pack on client, it was generating machine id but with duplicate entry of id and machine name.

I believed, database got broken for that particular machine group and i created new machine group and started moving machines from old group to thins new group. On a sudden after two days, around 30 machined were wiped out from database. Now total wiped machine count is near 60. I am afraid if this gonna increase this count.

Please suggest if anyone have suggestions in this situation.

Thanks,

Nikhil

5 Replies
Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 2 of 6

Re: Machine and User accounts are getting automatically wiped from EEM.

work out the machine ID, then go look in the physical database for that machines folder.

If it's marked as .rmv then someone (or some script) deleted it. If it's marked as .wpe, then something deleted it and purged it from the recycle bin. If the folder simply does not exist, then something outside of EEM is touching the database (which is forbidden).

That should give you a clue as to what's going on.

You should be able to restore these machines from your DB backup, once you've worked out if they are removed or wiped etc.

Re: Machine and User accounts are getting automatically wiped from EEM.

Thanks Safeboot... i did check and found that .wpe folder exists under database.

I checked everything on server and found all deleted objects log in Admin user audit.

11/28/2014 12:110x01000085ID=000023af\Type=00000002Delete object

I am not sure if someone deleted those objects. Are there any other way server can delete objects automatically?

And, if i delete an object manually with Permanently delete object option, will it create a .wpe for that object too?

Thanks!

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 4 of 6

Re: Machine and User accounts are getting automatically wiped from EEM.

yes, if something is cleared from the bin, it changes from .rmv to .wpe.

If you have an audit log that an admin is deleting the machines, then either the person is, or some script is logging on as that user and doing it. No, the server won't delete things on its own - it never needs to.

Re: Machine and User accounts are getting automatically wiped from EEM.

Thanks gain Safeboot for your response!!

Machine accounts deleted from database had random IDs, i mean not in a row though installation was made in a row and IDs generated in a row. I am not sure if any script can do that.

I started believing that someone intentionally had deleted objects from database.

Can give me any other clue?

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: Machine and User accounts are getting automatically wiped from EEM.

well, there should be only one person using the Admin account - They seem to be the one causing the problems?

Are you using any scripts which touch the EEM APIs perhaps?

Member Rewards
McAfee Community rewards active and helpful members just like you. Click here to take a look at the first community members who received a special reward and were recognized by McAfee leader, Aneel Jaeel, for their participation and trusted knowledge in the community.