1 of 1 people found this helpful
Do these machines have HIPS installed?
Yes! Yes they do! HIPS 18.104.22.1680. This is installed on all the clients, but only thirty out of two hundred clients are having the problem.
Ok, I've seen this before. Uninstall HIPS and then collect and send props. I'd bet it will then report all the attibutes back to ePO. Then reboot and reinstall HIPS. This seems to stem from some sort of corruption in the HIPS install.
Thanks for the info. The problem here is that we're managing separately-owned enclaves and each is ruled by their own admins who are hostile to the idea of giving "outsiders" any administrative access to their clients. So, I can't reboot their machines.
So, I took your advice and modified it slightly. Instead of uninstalling HIPS, I disabled it via the IPS policy. Once HIPS disabled, about half of the non-compliant machines reported in with correct props. The other half remained the same. Those, I'll have to get their admins to fix.
Thanks for your timely help!