I have faced one Issue in Epo, as 1 of the Systems got removed from epo & i found no entry logged in Audit Logs.
Anyone can help me in this...
Thanks in Advance.
Can any one help to find When & How the Systems got Removed from ePO, I have checked Audit logs & Agent Uninstalls Attepmts Query but unable to find any Entry for that Particular system.
First reasonable guess would be a regular maintenance server task which deletes inactive agents (for systems that got their agents uninstalled by whomever/whatever).
Second would be also a server task, named Duplicate agentGUIDs - remove systems with potentially duplicated GUIDs (this is more likely to happen I would say).
(there can be more, though)
However I cannot say these should be shown in the Audit Logs as I am not sure of it.
By far the most common reason I've seen this occur is duplicate MAC addresses and the solution (if that is the root cause) is documented in KB52949.
EPO uses the following algorithm to match up properties packages sent up by clients to entries in the system tree:
1- Agent GUID
2- MAC address
3- System name
Once it finds a match in the above algorithm it exits. So if for some reason multiple machines are reporting the same MAC address (VPN clients will often report the MAC address of the VPN concentrator or VM machines may not have had the MAC address reset when they were cloned) and just one of those machines don't have an entry in the system tree already on thier first agent-to-server communication it will overwrite another machines properties. Then when the machine that just had its properties overwritten communicates in it will in turn overwrite another machines properties. The KB article essentially has you write the vendor ID for the duplicate MAC to the DB on that MAC address will then be ignored for matching purposes.
Here is a query you can write to spot this:
You should have a list of mac addresses with a count of the number of systems reporting that MAC address. Ideally it would be a 1-to-1 ratio. If you have more than 1 system sharing the same MAC address then this is problably your issue.
Thanks for your reply....this is to Update you that Systems was not removed from AD,
Have you gone through the Post which was posted by Jstanley....thats sounds pritty good, but i want to know i thing, may i know what to do if i found more than 1 system sharing the same MAC Address??..............