Keep getting endpoints under Lost and Found container daily

[User94103427]

Hello, We are with ePO 5.1.3 and we do see close to 40 under lost and found container every day. We need to move them manually to the correct group on a daily basis. We need to understand why this is happening as i see those endpoints are not new to ePO and that rule out the Agent GUID issue. Note :we dont have any AD Sync enabled in our environment. Any solution or feedback to this will be of great help.. Thanks in advance

[cdinet]

Do you have any system tree sorting enabled?  What type of systems are these?  Are they the same systems over and over or random different ones?  Are there duplicate entries in epo?  What is different about these systems vs ones that don't do this?  Does the audit log show anything regarding these systems?

[Hawkmoon · Accepted solution]

Hi ‘User94103427’,

The ePO server you have has reached EOL as of 31^st Dec 2017, I’d advise you upgrade to a newer version to put your estate/server in a supported state.

ePO v 5.3.3 is to go EOL 31^st Dec 2019, so I’d suggest ePO v5.9.x is considered as it has a longer shelf life!

Confirmation of EOL status can be found here:

https://www.mcafee.com/enterprise/en-gb/support/product-eol.html

The devices that appear in the Lost and found container daily are doing so because ePO cannot work out what to do with them, there is a conflict of some sort stopping ePO from ’sorting’ them into one group or another. The result is it drops them into that container to wait for the ’admin’ to intervene and correct the condition.

I’m thinking a review the sorting criteria(s) you have/use is needed.

For example if you use IP ranges to define groups you may have an IP overlap. Devices with IP range ‘A’ moved to Group ‘A’, and devices with IP range ‘B’ moved to group ‘B’. An IP overlap is ‘true’ when units that appear in ‘lost and found’ have an IP that is ‘true/correct’ for both Group ‘A’ and ‘B’. – modify the IP ranges as needed.

If you use TAGs maybe theses need review as the units have the TAGs defined in two locations so maybe modify one of the TAGs for a group to make it more ‘unique’ and allow ePO to distinguish one device to a group from the other.

Once you have made a change use the ‘Test sort’ option to see if the modification is sufficient to solve the condition.

(More details on ‘sorting Criteria’, ‘TAGs’ and ‘lost and found’ can be found in PD27630 section 6 pages 59 through 85.)