Is there a log that lists why a system goes to Lost & Found?

[web1b]

The system tree is set to put systems in the system tree based on synching with active directory.

This is working for all systems except one.  We have already verified that there is no system with the same computer name in the system tree and verified the system is still joined to the domain.

Is there a log that states in plain English why a specific system isn't going to the correct place in the system tree and is being dumped back into Lost and Found even when we manually move it where it should be?

What are other reasons why a system would get moved back to lost and found even after manually moving it?

[cdinet]

Do you find a duplicate system anywhere?  Is the ad sync set to move systems to synchronized group?  Does the system move to lost and found when it checks back in?  Do you also have any other system tree sorting set up? Check the audit log - it will show if the system is being deleted during the sync or any other actions.  If there is a duplicate entry in epo for the system, delete all entries, then run the sync and let the system check itself back in to see if issue persists. 

[web1b]

I looked in ePO  and searched system wide and only this system has this exact system name in the entire system tree.

Is there any other attribute other than "system name" that creates duplicates?  If so, how can that be searched?

Which audit log?  Where is it?

I'm not sure when it moved back to lost and found.  I tried moving it, doing a remote wake up and it didn't move right away. I think moves hours later or overnight.

[cdinet · Accepted solution]

The audit log can be found going to the epo menu - I believe it is under reporting, depending on version of epo you are running (not queries and reporting tab).

If the system is being deleted for some reason and adding itself back to epo, we would want to see the audit log and agent logs.  For that, I would suggest opening a ticket with McAfee.

[web1b]

I found the audit log under "User Management."

The system keeps getting deleted when AD sync runs.  No explanation for this since it is a system in AD.

I assume it reappears in ePO into Lost and Found when it checks back into ePO after that.

Is there a solution for this?

[cdinet]

Try deleting the system first, then run ad sync and see if that fixes it.  If not, you might want to reinstall the agent with forceinstall and when it creates a duplicate entry, delete both of them and see if issue goes away after system checks back in.