cancel
Showing results for 
Search instead for 
Did you mean: 
jkaipa
Level 9
Report Inappropriate Content
Message 1 of 11

How to delete a system by its ID

Jump to solution

I see the api exposes system.delete, using which I can delete a system if I pass names=<SYSTEM_NAME>. I have multiple systems with the same name, but its GUID and MAC are different.

What is the other way to delete the system by its GUID?

1 Solution

Accepted Solutions
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 8 of 11

Re: How to delete a system by its ID

Jump to solution

Hi @jkaipa 

Disclaimer: I am not really an ePO expert here, but I think I have something that might just help you.

So, the ID mentioned in the document seems to refer to the Unique ID or AutoID that can be obtained for the machine using the below query:

https://eposerver:8443/remote/core.executeQuery?target=EPOLeafNode&select=(select EPOLeafNode.AutoID EPOComputerProperties.ComputerName)&where=(where(eq EPOComputerProperties.ComputerName "COMPUTERNAME"))

Source: https://community.mcafee.com/t5/ePolicy-Orchestrator/How-do-I-get-the-ParentID-from-a-single-API-req... 

Using this, you should get an output that has the "Unique ID" along with the System Name.

Now that this ID is obtained, the syntax for deletion would be as follows:

https://epo:8443/remote/system.delete?ids="UNIQUE ID"

This should work as tried and tested by me. Also, the "Unique ID" should vary for machines with same GUID as this ID is generated for every system entry on ePO, whether McAfee agent is installed or not! I am afraid I do not have machines with same GUIDs to test it out and hence I would request you to run the query for both the machines to confirm the same.

I sincerely hope this helps.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
10 Replies
McAfee Employee Thussain
McAfee Employee
Report Inappropriate Content
Message 2 of 11

Re: How to delete a system by its ID

Jump to solution

Essentially the order of operations will turn out like this - when a machine sends up a property package to ePO, ePO will first check the GUID attached to the property package. If there is a match, we're done. If there is no match, it'll check MAC address - same deal as before and if it matches, the inbound properties will be associated with the matching MAC address node.

If neither of these can match, we'll check for machines matching the computer name - however, in this case, that is only for "unmanaged" nodes matching the system name in the system tree. For example:
System name: EXAMPLE

When EXAMPLE communicates to ePO, with a new GUID and unique MAC address it will be unable to match to any existing system in your database based on those two criteria - then, it will check for any unmanaged entries (for example, added manually or via an AD sync) also named EXAMPLE. If it finds one, it'll match up with that unmanaged EXAMPLE system, essentially turning that previously unmanaged node into a managed node as far as ePO is concerned.

Now, if instead of finding an unmanaged system named EXAMPLE it finds a managed system named EXAMPLE (with a different GUID and MAC address associated of course) it would not match to this system and instead create a new entry, also named EXAMPLE, but with the new GUID/MAC address. This is designed as such to help out a bit in case the environment has machines with the same name throughout the environment (which isn't as uncommon as you'd think).

You may look for the query Duplicate Systems Names in Queries and Reports to list the duplicated systems. 

Why do you have machines with same name but different Agent guid and MAC address, are these machines active. 

I guess not all machines with same system name are active, probably they have been redeployed using a different mac address and Agent GUID. You can find the list of inactive agents by running the pre configured query Inactive Agents in queries and reports

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
jkaipa
Level 9
Report Inappropriate Content
Message 3 of 11

Re: How to delete a system by its ID

Jump to solution

Great, that explains how we get multiple systems with the same name in the system tree. 

How to use Web API "system.delete" to delete a specific system by its ID?

 

McAfee Employee LKS
McAfee Employee
Report Inappropriate Content
Message 4 of 11

Re: How to delete a system by its ID

Jump to solution

Hi jkaipa,

I have attached Web API guide which has more information including system deletion by ID or name.

https://docs.mcafee.com/bundle/epolicy-orchestrator-web-api-reference-guide/page/GUID-2503B69D-2BCE-... 

image.png

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a soultion" if this reply resolves your query!

jkaipa
Level 9
Report Inappropriate Content
Message 5 of 11

Re: How to delete a system by its ID

Jump to solution

It might be my ignorance, but tried to find the syntax and failed.

I tried below and didn't work

1) https://epobox:8443/remote/system.delete?names=24FF44F4-E3C9-11E9-0015-0676F47BD931

2) https://epobox:8443/remote/system.delete?guid=24FF44F4-E3C9-11E9-0015-0676F47BD931

3) https://epobox:8443/remote/system.delete?id=24FF44F4-E3C9-11E9-0015-0676F47BD931

The documentation says name or id. How to use the ID? What is the syntax.

Thanks

McAfee Employee LKS
McAfee Employee
Report Inappropriate Content
Message 6 of 11

Re: How to delete a system by its ID

Jump to solution

You have to type system hostname next to "names". Am really not sure what "ID" refers in the system tree. 

1) https://epobox:8443/remote/system.delete?names=24FF44F4-E3C9-11E9-0015-0676F47BD931

Example :

1) https://epobox:8443/remote/system.delete?names=system1

Please be informed Web API scripting is out of our support scope. I will try my level best.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a soultion" if this reply resolves your query!

jkaipa
Level 9
Report Inappropriate Content
Message 7 of 11

Re: How to delete a system by its ID

Jump to solution

Thanks for your response.

https://epobox:8443/remote/system.delete?names=system1 works for me too.

But I have 2 systems with the same name, with its id's and macs are different. I want to delete a specific system by its id. 

 

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 8 of 11

Re: How to delete a system by its ID

Jump to solution

Hi @jkaipa 

Disclaimer: I am not really an ePO expert here, but I think I have something that might just help you.

So, the ID mentioned in the document seems to refer to the Unique ID or AutoID that can be obtained for the machine using the below query:

https://eposerver:8443/remote/core.executeQuery?target=EPOLeafNode&select=(select EPOLeafNode.AutoID EPOComputerProperties.ComputerName)&where=(where(eq EPOComputerProperties.ComputerName "COMPUTERNAME"))

Source: https://community.mcafee.com/t5/ePolicy-Orchestrator/How-do-I-get-the-ParentID-from-a-single-API-req... 

Using this, you should get an output that has the "Unique ID" along with the System Name.

Now that this ID is obtained, the syntax for deletion would be as follows:

https://epo:8443/remote/system.delete?ids="UNIQUE ID"

This should work as tried and tested by me. Also, the "Unique ID" should vary for machines with same GUID as this ID is generated for every system entry on ePO, whether McAfee agent is installed or not! I am afraid I do not have machines with same GUIDs to test it out and hence I would request you to run the query for both the machines to confirm the same.

I sincerely hope this helps.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Employee LKS
McAfee Employee
Report Inappropriate Content
Message 9 of 11

Re: How to delete a system by its ID

Jump to solution

Finally am able to make it. 

First run the below command to get the system location ID :

https://epobox:8443/remote/system.find?searchText=systemname

Once you get the ID, then execute the below command to delete system.

https://epobox:8443/remote/system.delete?ids="id number"

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a soultion" if this reply resolves your query!

McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 10 of 11

Re: How to delete a system by its ID

Jump to solution

Hi @jkaipa 

I was also going through the tables form DB and as used in the query, we can see that the dbo.EPOLeafeNodeMT table has AutoID and NodeName listed where as the same information is available in the table dbo.EPOComputerPropertiesMT as ParentID and ComputerName.

Just thought this may help you simplify or modify the above query. The takeaway is UniqueID == AutoID==ParentID. Feel free to correct me if I am wrong! Happy to learn! I sincerely hope this helps as well!

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community