3 Replies Latest reply on Dec 27, 2011 2:51 PM by Juice!

    Managed to Rogue


      How can a machine that has been in Managed systems become a rogue? Seems like I get a lot of these lately. I have machines that have been managed for months go to rogue and the last detected time was 3 months ago. I also get some that are put into exceptions (printers) that come back as rogue. for instance, we installed a brand new machine yeterday, added the latest framework package adn it went right into managed systems, which is what I expected. half hour later it goes in as a rogue system. Actually, looking at it again I see it is still in managed system yet it is also in rogue systems

        • 1. Re: Managed to Rogue

          on a particular machine I noticed the Agent GUID has changed, within an our and a half. what makes the GUID change?


          Message was edited by: scoutt on 12/22/11 10:11:48 AM CST
          • 2. Re: Managed to Rogue

            Anybody? I had about 200 more go rogue on me over the weekend and some are 6 months old. As far as last detected time is concerned.

            • 3. Re: Managed to Rogue

              Just shooting some ideas here...


              --Do any of these systems have an RSD sensor in common?  Try removing/reinstalling or choose another location

              --Do you have a task that runs daily to reinstall the McAfee agent?  Is run on every policy enforcement interval selected?  I have run into issues where the agent install process begins and hangs, GUID may have changed but communication is not happening.

              --Do you have the Duplicate GUID server tasks running?  If you have an issue with many systems using the same GUID you will see systems "moving" around...every check-in the latest system will overwrite the previous one's system details.  That may cause it to be a rogue one minute, managed system the next.

              --Do you have agents on a subnet that can't talk back to ePO?  RSD sensor on one subnet that can communicate may pick them up, but subnet they are on may not be able to hit ePO.