5 Replies Latest reply on Nov 5, 2008 6:13 AM by Johonn

    Dup, Computers (reuse of SystemName)

      This is a little messy so forgive me. We are having an issue where SystemName's are being reused when the mcafee agent checks in. The GIUD so far seem to be unique. That does not make sense, right? Let me explain.


      I was updating a system the other day when i forced an update from the PC, it checked in with all the system props. I then went to modify the task on the system when i noticed the SystemName was not the system it should have been. what the hell i said. After some looking into i was following this chaning computer name with an unknown # of SystemsName's ( i have 15 writen down) I decided to move this system into the Lost&Found group.

      I then ran the Dup System query and removed all Dups. Keep in mind we sync with AD. What i have now is a Dup. systems changing over and over. I have the system in the correct location for the group (matched with the AD sync) with a Dup with the system in the lost&found. Understand that the Dup system query produces different results all the time. The only computer that stays the same is this one in the lost&found but the computer name changes but the total count of dup systems stays the same. Doesn't make sense i know.


      From what i can see these systems do not have the same GUID, IP address, MAC address or SystemName.

      Does anyone have a suggestion as to why Macfee is recycling the same computer object? I would also be corious if someone anyone else can noticed this action.

      Versions
      EPO 4.0 patch 2 (i think, it is the lastest)
      EPO Agents 4.0
      VSE:8.5 patch 5
        • 1. RE: Dup, Computers (reuse of SystemName)
          Hello Johonn,

          i had the same case like you, but i can solve it. What i have do:

          - move the computer object from lost&found to the right location where
          are the other dup
          - delete the one who have the older connection time stamp (or no time stamp)
          - edit your AD syncronisation and enable the option "delete computer from systemtree" on the bottom
          - after that do a resync
          • 2. RE: Dup, Computers (reuse of SystemName)
            Well i gave it a try but it did not seem to fix the issue as it is still reusing computer objects. Also i did notice in the registry for MAC Addresses that one of the MAC address are the same and this is for the Cisco VPN network adapter. Now i have queried Cisco about the same MAC address being used and they said the MAC address is hard coded in the version of VPN. We do have multiple version of VPN being used.

            Now my question is could this be the issue? I am getting the reuse when a computer with the same version of VPN with the same MAC address, when the agent updates. If that is the case there should be no way i am the only one having this issue, so i ask any one else using EPO4 and Cisco VPN to check.

            All these duplicates seem to have an IP address range that falls within our VPN range. Is there a way to get ePO 4 to ignore the MAC address when deciding if the agent is new or not.

            VPN version is 4.8.00.0440 and the MAC ends in 3C:78:00. A search from the quick search in Mcafee for 3C7800 shows about 175 results with this MAC address.
            • 3. Try This
              We have an ongoing issue with McAfee on VMWAre Cloning but in that process they gave me this KB

              Document ID: 615809

              See if that covers your issue.
              • 4. RE: Try This
                That sounds pretty close to the issue. I will have to make the changes and see if it works. We migrated from ePO 3.6 to 4.0 so there is a very good chance the first communication was over VPN.
                • 5. RE: Try This
                  So i finally was able to get this code run on the DB and well it seems that it WORKED!!!! My number of unknown computers went down by about 250 and now reflects closer to the actually number of computers we have. I also have had no duplicate computers in the past couple of days.