Showing results for 
Search instead for 
Did you mean: 

Duplicate GUID's

I think we have a problem with duplicate GUID's.

We have a number of machines on our network that have been cloned using Norton Ghost. Which contained the McAfee agent as part of the image.

Is there a way to check if there is any duplicate GUID's, and how can this be fixed.
20 Replies
Level 7
Report Inappropriate Content
Message 2 of 21

RE: Duplicate GUID's

Hello, in the hosts that ware cloned delete the following registry key

HKLM\software\network associates\epolicy orchestrator\agent\agentguid

Delete just the string agentguid then restart the mcafee framework service
it will generate a new one happy
Level 7
Report Inappropriate Content
Message 3 of 21

RE: Duplicate GUID's

This is indeed the fix for this problem, we got bit with this same issue a while back. It's a little scary when thousands of machines suddenly start pulling their daily updates at 5 o'clock since they never checked in to EPO to realize they should update at night... :eek:

RE: Duplicate GUID's

I ended up with something similar to the following:

@Echo Off
Echo Checking EPO Agent

if exist c:\windows\epogui.txt goto end

net stop McAfeeFramework /yes >nul
net stop McShield /yes >nul
net stop McTaskManager /yes >nul

REG delete "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent" /v AgentGUID /F >nul
REG delete "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent" /v MacAddress /F >nul

del /q "%DEFLOGDIR%\AccessProtectionLog.txt" >nul
del /q "%DEFLOGDIR%\BufferOverflowProtectionLog.txt" >nul
del /q "%DEFLOGDIR%\EmailOnDeliveryLog.txt" >nul
del /q "%DEFLOGDIR%\OnAccessScanLog.txt" >nul
del /q "%DEFLOGDIR%\OnDemandScanLog.txt" >nul
del /q "%DEFLOGDIR%\UpdateLog.txt" >nul
del /q "c:\quarantine\*.*" >nul

net start McAfeeFramework /yes >nul
net start McShield /yes >nul
net start McTaskManager /yes >nul

copy \\\files\corpnet\clients\epo\epogui.txt c:\windows
cd ..
cd ..
cd ..

"C:\Program Files\McAfee\Common Framework\CmdAgent.exe" /p /e /c


And used PSEXEC to deploy to the affected clients
Level 11
Report Inappropriate Content
Message 5 of 21

RE: Duplicate GUID's

You can use this SQL script to see the duplicate GUIDs and the number of machines affected. (copy and paste into QueryAnalyzer).

SELECT DISTINCT cast(productEvents.AgentGUID as varchar(50)) AS AgentGUID , HostName FROM ProductEvents
WHERE (AgentGUID IN (SELECT DISTINCT ProductEvents.AgentGUID FROM ProductEvents, ProductEvents as PE2
WHERE (ProductEvents.AgentGUID = PE2.AgentGUID)
AND (ProductEvents.HostName <> PE2.HostName)
AND (ProductEvents.EventDateTime > dateadd (day, -1, GetDate()))
AND (PE2.EventDateTime > dateadd (day, -1, GetDate()))))
AND (EventDateTime > dateadd (day, -1, GetDate())) ORDER BY AgentGUID, HostName

How many client machines are you managing with ePO?

If a smaller number; a simpler solution would be to just deploy the CMA again with the /forceinstall switch. This will regenerate the AgentGUID.

If a larger number; you could make a script that deletes the AgentGUID registry value and restarts the framework service to regenerate, and then deploy it with SMS or similar.


Level 7
Report Inappropriate Content
Message 6 of 21

RE: Duplicate GUID's

If I run this in query anal. I get:
Server: Msg 208, Level 16, State 1, Line 1
Invalid object name 'ProductEvents'.

EDIT - nevermind, it helps if you select the right DB !
Level 7
Report Inappropriate Content
Message 7 of 21

RE: Duplicate GUID's

I'm getting the same error:
If I run this in query anal. I get:
Server: Msg 208, Level 16, State 1, Line 1
Invalid object name 'ProductEvents'.
But I am running it on the correct DB. Any suggestions?
Level 7
Report Inappropriate Content
Message 8 of 21

RE: Duplicate GUID's


if you use EPO 4 the tables are named differently, see the KB51708

tb_ng McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 9 of 21

RE: Duplicate GUID's

Is this query available anywhere in xml so that it can be imported into epo 4 or does it have to be run from QA?

RE: Duplicate GUID's

I run into the duplicate guid issue all the time.

Can anyone confirm if there will be a way to reset the guids in epolicy 4.5? I heard this might be a potential but haven't tried the beta yet. Was wondering if it is in the beta, or is planning on being in 4.5 rc.

Also, if the above is true about 4.5, is there a chance or way to do it in 4.0 as an undocumented feature, or was it something completly added to only 4.5 due to many people having run into this issue? (i.e. many companies the epolicy person may never touch Ghost, etc.)
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community