The system tree is set to put systems in the system tree based on synching with active directory.
This is working for all systems except one. We have already verified that there is no system with the same computer name in the system tree and verified the system is still joined to the domain.
Is there a log that states in plain English why a specific system isn't going to the correct place in the system tree and is being dumped back into Lost and Found even when we manually move it where it should be?
What are other reasons why a system would get moved back to lost and found even after manually moving it?
Solved! Go to Solution.
The audit log can be found going to the epo menu - I believe it is under reporting, depending on version of epo you are running (not queries and reporting tab).
If the system is being deleted for some reason and adding itself back to epo, we would want to see the audit log and agent logs. For that, I would suggest opening a ticket with McAfee.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Do you find a duplicate system anywhere? Is the ad sync set to move systems to synchronized group? Does the system move to lost and found when it checks back in? Do you also have any other system tree sorting set up? Check the audit log - it will show if the system is being deleted during the sync or any other actions. If there is a duplicate entry in epo for the system, delete all entries, then run the sync and let the system check itself back in to see if issue persists.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
I looked in ePO and searched system wide and only this system has this exact system name in the entire system tree.
Is there any other attribute other than "system name" that creates duplicates? If so, how can that be searched?
Which audit log? Where is it?
I'm not sure when it moved back to lost and found. I tried moving it, doing a remote wake up and it didn't move right away. I think moves hours later or overnight.
The audit log can be found going to the epo menu - I believe it is under reporting, depending on version of epo you are running (not queries and reporting tab).
If the system is being deleted for some reason and adding itself back to epo, we would want to see the audit log and agent logs. For that, I would suggest opening a ticket with McAfee.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
I found the audit log under "User Management."
The system keeps getting deleted when AD sync runs. No explanation for this since it is a system in AD.
I assume it reappears in ePO into Lost and Found when it checks back into ePO after that.
Is there a solution for this?
Try deleting the system first, then run ad sync and see if that fixes it. If not, you might want to reinstall the agent with forceinstall and when it creates a duplicate entry, delete both of them and see if issue goes away after system checks back in.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA