cancel
Showing results for 
Search instead for 
Did you mean: 
hemantk
Level 12
Report Inappropriate Content
Message 1 of 11

System got Deleted from ePO

Hello.....

I have faced one Issue in Epo, as 1 of the Systems got removed from epo & i found no entry logged in Audit Logs.

Anyone can help me in this...

Thanks in Advance.

10 Replies
hemantk
Level 12
Report Inappropriate Content
Message 2 of 11

Re: System got Deleted from ePO

Can any one help to find When & How the Systems got Removed from ePO, I have checked Audit logs & Agent Uninstalls Attepmts Query but unable to find any Entry for that Particular system.

apoling
Level 14
Report Inappropriate Content
Message 3 of 11

Re: System got Deleted from ePO

Hello,

First reasonable guess would be a regular maintenance server task which deletes inactive agents (for systems that got their agents uninstalled by whomever/whatever).

Second would be also a server task, named Duplicate agentGUIDs - remove systems with potentially duplicated GUIDs (this is more likely to happen I would say).

(there can be more, though)

However I cannot say these should be shown in the Audit Logs as I am not sure of it.

Attila

hemantk
Level 12
Report Inappropriate Content
Message 4 of 11

Re: System got Deleted from ePO

Hello Attila.

Thanks for ur reply, Sorry to say that in my last post i forgot to mention that we havent configured any Server Task to Delete Systems.

Highlighted
McAfee Employee jstanley
McAfee Employee
Report Inappropriate Content
Message 5 of 11

Re: System got Deleted from ePO

By far the most common reason I've seen this occur is duplicate MAC addresses and the solution (if that is the root cause) is documented in KB52949.

EPO uses the following algorithm to match up properties packages sent up by clients to entries in the system tree:

1- Agent GUID

2- MAC address

3- System name

Once it finds a match in the above algorithm it exits. So if for some reason multiple machines are reporting the same MAC address (VPN clients will often report the MAC address of the VPN concentrator or VM machines may not have had the MAC address reset when they were cloned) and just one of those machines don't have an entry in the system tree already on thier first agent-to-server communication it will overwrite another machines properties. Then when the machine that just had its properties overwritten communicates in it will in turn overwrite another machines properties. The KB article essentially has you write the vendor ID for the duplicate MAC to the DB on that MAC address will then be ignored for matching purposes.

Here is a query you can write to spot this:

  1. Logon to ePO
  2. Select Menu | Reporting | Queries | New Query
  3. Select System Management | Managed Systems | Next
  4. Select Singe Group Summary Table
  5. In the Labels Are: drop down list select MAC Address under Computer Propertes | Next
  6. Add Mac Address as a Selected Column | Next
  7. Select Managed state equals true as a filter | Run

You should have a list of mac addresses with a count of the number of systems reporting that MAC address. Ideally it would be a 1-to-1 ratio. If you have more than 1 system sharing the same MAC address then this is problably your issue.

hemantk
Level 12
Report Inappropriate Content
Message 6 of 11

Re: System got Deleted from ePO

Hello Jstanley.

Thanks for your Reply...may i know what to do if i found more than 1 system sharing the same MAC Address??..............

rackroyd
Level 16
Report Inappropriate Content
Message 7 of 11

Re: System got Deleted from ePO

Also, AD-Synch tasks may remove as well as add machines - if the machine were removed from AD this might be reflected in the ePO system tree after.

Rgds,

Rob.

hemantk
Level 12
Report Inappropriate Content
Message 8 of 11

Re: System got Deleted from ePO

Hello Rackroyd.

Thanks for your reply....this is to Update you that Systems was not removed from AD,

Have you gone through the Post which was posted by Jstanley....thats sounds pritty good, but i want to know i thing, may i know what to do if i found more than 1 system sharing the same MAC Address??..............

apoling
Level 14
Report Inappropriate Content
Message 9 of 11

Re: System got Deleted from ePO

Would you please tell us the ePO server version (I have the impression this might affect the answer to your query).

Thanks.

Attila

hemantk
Level 12
Report Inappropriate Content
Message 10 of 11

Re: System got Deleted from ePO

Hello Attila.

McAfee ePO 4.5 Patch 4 Hotfix 1

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community