1 2 Previous Next 10 Replies Latest reply on Jul 12, 2011 1:57 AM by Attila Polinger

    System got Deleted from ePO

    Hemant Koli

      Hello.....

       

      I have faced one Issue in Epo, as 1 of the Systems got removed from epo & i found no entry logged in Audit Logs.

       

      Anyone can help me in this...

       

      Thanks in Advance.

        • 1. Re: System got Deleted from ePO
          Hemant Koli

          Can any one help to find When & How the Systems got Removed from ePO, I have checked Audit logs & Agent Uninstalls Attepmts Query but unable to find any Entry for that Particular system.

          • 2. Re: System got Deleted from ePO
            Attila Polinger

            Hello,

             

            First reasonable guess would be a regular maintenance server task which deletes inactive agents (for systems that got their agents uninstalled by whomever/whatever).

            Second would be also a server task, named Duplicate agentGUIDs - remove systems with potentially duplicated GUIDs (this is more likely to happen I would say).

            (there can be more, though)

             

            However I cannot say these should be shown in the Audit Logs as I am not sure of it.

             

            Attila

            • 3. Re: System got Deleted from ePO
              Hemant Koli

              Hello Attila.

               

              Thanks for ur reply, Sorry to say that in my last post i forgot to mention that we havent configured any Server Task to Delete Systems.

              • 4. Re: System got Deleted from ePO
                jstanley

                By far the most common reason I've seen this occur is duplicate MAC addresses and the solution (if that is the root cause) is documented in KB52949.

                 

                EPO uses the following algorithm to match up properties packages sent up by clients to entries in the system tree:

                1- Agent GUID

                2- MAC address

                3- System name

                 

                Once it finds a match in the above algorithm it exits. So if for some reason multiple machines are reporting the same MAC address (VPN clients will often report the MAC address of the VPN concentrator or VM machines may not have had the MAC address reset when they were cloned) and just one of those machines don't have an entry in the system tree already on thier first agent-to-server communication it will overwrite another machines properties. Then when the machine that just had its properties overwritten communicates in it will in turn overwrite another machines properties. The KB article essentially has you write the vendor ID for the duplicate MAC to the DB on that MAC address will then be ignored for matching purposes.

                 

                Here is a query you can write to spot this:

                1. Logon to ePO
                2. Select Menu | Reporting | Queries | New Query
                3. Select System Management | Managed Systems | Next
                4. Select Singe Group Summary Table
                5. In the Labels Are: drop down list select MAC Address under Computer Propertes | Next
                6. Add Mac Address as a Selected Column | Next
                7. Select Managed state equals true as a filter | Run

                 

                You should have a list of mac addresses with a count of the number of systems reporting that MAC address. Ideally it would be a 1-to-1 ratio. If you have more than 1 system sharing the same MAC address then this is problably your issue.

                1 of 1 people found this helpful
                • 5. Re: System got Deleted from ePO
                  Hemant Koli

                  Hello Jstanley.

                   

                  Thanks for your Reply...may i know what to do if i found more than 1 system sharing the same MAC Address??..............

                  • 6. Re: System got Deleted from ePO
                    rackroyd

                    Also, AD-Synch tasks may remove as well as add machines - if the machine were removed from AD this might be reflected in the ePO system tree after.

                     

                    Rgds,

                     

                    Rob.

                    • 7. Re: System got Deleted from ePO
                      Hemant Koli

                      Hello Rackroyd.

                       

                      Thanks for your reply....this is to Update you that Systems was not removed from AD,

                      Have you gone through the Post which was posted by Jstanley....thats sounds pritty good, but i want to know i thing, may i know what to do if i found more than 1 system sharing the same MAC Address??..............

                      • 8. Re: System got Deleted from ePO
                        Attila Polinger

                        Would you please tell us the ePO server version (I have the impression this might affect the answer to your query).

                         

                        Thanks.

                         

                        Attila

                        • 9. Re: System got Deleted from ePO
                          Hemant Koli

                          Hello Attila.

                           

                          McAfee ePO 4.5 Patch 4 Hotfix 1

                          1 2 Previous Next