1 2 3 Previous Next 20 Replies Latest reply on Sep 24, 2009 8:53 AM by spuryear

    Duplicate GUID's

      I think we have a problem with duplicate GUID's.

      We have a number of machines on our network that have been cloned using Norton Ghost. Which contained the McAfee agent as part of the image.

      Is there a way to check if there is any duplicate GUID's, and how can this be fixed.
        • 1. RE: Duplicate GUID's
          Hello, in the hosts that ware cloned delete the following registry key

          HKLM\software\network associates\epolicy orchestrator\agent\agentguid

          Delete just the string agentguid then restart the mcafee framework service
          it will generate a new one happy
          • 2. RE: Duplicate GUID's
            This is indeed the fix for this problem, we got bit with this same issue a while back. It's a little scary when thousands of machines suddenly start pulling their daily updates at 5 o'clock since they never checked in to EPO to realize they should update at night... :eek:
            • 3. RE: Duplicate GUID's
              I ended up with something similar to the following:

              @Echo Off
              Echo Checking EPO Agent

              if exist c:\windows\epogui.txt goto end

              net stop McAfeeFramework /yes >nul
              net stop McShield /yes >nul
              net stop McTaskManager /yes >nul

              REG delete "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent" /v AgentGUID /F >nul
              REG delete "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent" /v MacAddress /F >nul

              del /q "%DEFLOGDIR%\AccessProtectionLog.txt" >nul
              del /q "%DEFLOGDIR%\BufferOverflowProtectionLog.txt" >nul
              del /q "%DEFLOGDIR%\EmailOnDeliveryLog.txt" >nul
              del /q "%DEFLOGDIR%\OnAccessScanLog.txt" >nul
              del /q "%DEFLOGDIR%\OnDemandScanLog.txt" >nul
              del /q "%DEFLOGDIR%\UpdateLog.txt" >nul
              del /q "c:\quarantine\*.*" >nul

              net start McAfeeFramework /yes >nul
              net start McShield /yes >nul
              net start McTaskManager /yes >nul

              copy \\corporate.group.local\files\corpnet\clients\epo\epogui.txt c:\windows
              cd ..
              cd ..
              cd ..

              "C:\Program Files\McAfee\Common Framework\CmdAgent.exe" /p /e /c


              And used PSEXEC to deploy to the affected clients
              • 4. RE: Duplicate GUID's
                You can use this SQL script to see the duplicate GUIDs and the number of machines affected. (copy and paste into QueryAnalyzer).

                SELECT DISTINCT cast(productEvents.AgentGUID as varchar(50)) AS AgentGUID , HostName FROM ProductEvents
                WHERE (AgentGUID IN (SELECT DISTINCT ProductEvents.AgentGUID FROM ProductEvents, ProductEvents as PE2
                WHERE (ProductEvents.AgentGUID = PE2.AgentGUID)
                AND (ProductEvents.HostName <> PE2.HostName)
                AND (ProductEvents.EventDateTime > dateadd (day, -1, GetDate()))
                AND (PE2.EventDateTime > dateadd (day, -1, GetDate()))))
                AND (EventDateTime > dateadd (day, -1, GetDate())) ORDER BY AgentGUID, HostName

                How many client machines are you managing with ePO?

                If a smaller number; a simpler solution would be to just deploy the CMA again with the /forceinstall switch. This will regenerate the AgentGUID.

                If a larger number; you could make a script that deletes the AgentGUID registry value and restarts the framework service to regenerate, and then deploy it with SMS or similar.


                • 5. RE: Duplicate GUID's

                  If I run this in query anal. I get:
                  Server: Msg 208, Level 16, State 1, Line 1
                  Invalid object name 'ProductEvents'.

                  EDIT - nevermind, it helps if you select the right DB !
                  • 6. RE: Duplicate GUID's
                    I'm getting the same error:
                    If I run this in query anal. I get:
                    Server: Msg 208, Level 16, State 1, Line 1
                    Invalid object name 'ProductEvents'.
                    But I am running it on the correct DB. Any suggestions?
                    • 7. A question, if you don't mind

                      Is epogui.txt just a drop in to indicate you've already cleared the GUID and MAC, or is it something else entirely?


                      • 8. RE: Duplicate GUID's

                        if you use EPO 4 the tables are named differently, see the KB51708


                        • 9. RE: Duplicate GUID's

                          Is this query available anywhere in xml so that it can be imported into epo 4 or does it have to be run from QA?
                          1 2 3 Previous Next