Agent Upgrade via client task - Laptops duplicating

[jround]

Pushing out McAfee Agent 5.6.1.157 via a client task assignment I have noticed that quite a lot of systems are creating duplicate entries in ePO, in particular laptop devices.

The problem is we manually tag them for encryption purposes (I am in the middle of changing that to a more automated process) so if a device does have a new entry created I have to go through the 'Duplicate Systems' report and match up the tags with the old entry which is no longer communicating

However this does not affect all laptops, I have done around 500 and only had the issue on around 50 so far, potentially the users are roaming around a bit so may be continually hitting new IP addressing but the mac address for both entries is exactly the same which I thought ePO now looked at rather than IP?

Looking at the logs for one it does seem to suggest the Agent has reinstalled itself rather than upgrading too

[Hem]

Can you share the steps you are following to upgrade MA via client task? I tried with product deployment but couldn't reproduce it.

[cdinet]

By any chance did you add forceinstall to the command line for the agent deployment task? 

Also, are these laptops connecting via vpn?  If so, have you ensured to follow kb52949?  That doesn't usually cause duplicates, but could have some strange effects. 

What version of epo?  Do you use AD sync and have you noticed if they come in duplicate after an AD sync?

The frminst log will show if there was any forceinstall done for any reason.  If so, then yes, that would create duplicates.  See KB86879 for that.  If there was a forceinstall and your client task is not set to run it that way, then I would check time frames that the agent was reinstalled - does it match the task runtime?  If not, is there anything in the server task log suggesting someone may have run deploy agent to it?

[jround]

I cannot find anything consistent as to why some systems duplicate at the moment, not specifying /forceinstall or anything in the task, maybe I just need to upgrade ePO from 5.9.1 to 5.10 at some point

I have also noticed a far more alarming issue in that a number of clients seem to be in a 'zombie' state in ePO, they report as last communicated last month yet when I checked they are actually online live clients!  Deploying the latest Agent 5.6.1 as a force over the top install seems to bring them back to life in ePO but a bit worrying!

[cdinet]

For agent communication issues, the masvc log on the client will show specific failures.  You need to match that time frame of the communication attempt to the server or agent handler server logs for same time frame.  There are 2 ways communication can fail.

1. server never receives the agent communication attempt to log it - can occur if client can't reach server, ssl communication is rejected (wrong certificate, firewall doing ssl inspection, etc) or other network issues.

2. Client reaches server, but server is either busy, rejects it for some reason - the server log would show that.