Duplicate Systems ni ePO

[arnieos]

Hi,

We have hundreds of duplicate systems in our ePO and it is affecting our reporting. Some have more than 2 duplicates. 1 system is updated, and the rest is outdated. Where should we start checking for the issue? And is there a way to delete the outdated duplicate systems and leave the updated one? Can it be done through SQL query, ePO task or anything?

Manually deleting them will obviously take a while. 

ePO version is 5.10.0 Update 4 and McAfee Agent version is mostly 4.8.0 with some 5.0.6.

Thanks.

[Hem]

MA 4.8 is EOL.

Possible causes:

Duplicate systems in the System Tree after a McAfee Agent force installation over an existing version

Technical Articles ID:   KB86879

https://community.mcafee.com/t5/ePolicy-Orchestrator/Duplicated-systems/td-p/467303

[cdinet]

There are many reasons for duplicates, and one that Hem pointed out is definitely one. Are these systems vm's or just normal systems? Have you noticed if they show as duplicates after an AD sync or other action in epo, or just randomly? I would definitely suggest upgrading the agents - 4.8 reached end of life March of last year and the 5.0.x agent will reach end of life the end of this year and has a lot of known issues. Here is a query you can use to remove the duplicates, but please validate table name - it may end in MT depending on epo version. delete from epoleafnode where exists (select * from epoleafnode as l where .nodename=epoleafnode.nodename and l.autoid!=epoleafnode.autoid and .lastupdate>epoleafnode.lastupdate)

[arnieos]

It's a mix of vm's and normal systems. The AD sync only happens in a specific group n System Tree and it does not contain a duplicate systems. Some of the duplicate systems have different IP addresses and last communication date with the updated one having the latest communication date. Any settings I should check?

Agent upgrade is ongoing and being reviewed by the organization. Can you confirm, the query will delete duplicate systems and will not delete the updated one? 

Thanks for the help.

[cdinet]

It will retain the last communication one. Be sure with your agent installs/upgrades that you are not using forceinstall. That will create duplicates.

[arnieos]

I updated the query with the following:

"delete from EPOLeafNodeMT where exists (select * from EPOLeafNodeMT as l where .NodeName=epoleafnodeMT.NodeName and l.autoid!=epoleafnodeMT.autoid and .LastUpdate>epoleafnodeMT.LastUpdate)"

Got an error:

"Msg 4104, Level 16, State 1, Line 1
The multi-part identifier ".NodeName" could not be bound.
Msg 4104, Level 16, State 1, Line 1
The multi-part identifier ".LastUpdate" could not be bound."

And another question, if the last communication one is also outdated, will it delete this one as well?

Thanks.

[cdinet]

Google search on that error returns this: The main reason for this error is that the source table cannot be found Try running the original query without modifying it. It may be looking at a view instead of table. No, if the last communication is not current, that doesn't matter. It is retaining the one with the latest communication, even if it is out of date.

[cdinet]

If running it without modifying table name fails, then make sure you are running it on the epo database and not master. There is a dropdown box in top left side that you can choose the db.

[arnieos]

Correct db was selected. I ran the original query and it failed with the same error message. 

I tried updating the ".nodename" to "epoleafnodeMT.NodeName", the first 2 line of error message disappeared. If I update ".lastupdate" to "epoleafnodeMT.LastUpdate", I have a feeling it might work. So the updated query looks like this.

delete from EPOLeafNodeMT where exists (select * from EPOLeafNodeMT as l where epoleafnodeMT.NodeName=epoleafnodeMT.NodeName and l.autoid!=epoleafnodeMT.autoid and epoleafnodeMT.LastUpdate>epoleafnodeMT.LastUpdate)

Should I try it? And should we get the same expected results?

Thanks.

[cdinet]

Yes, you can try it and yes, it should result in same expected results.