Duplicate systems in the systems tree

[hugo2069]

We currently have over 9000 systems in ePO. We currently have 36 systems that are duplicated. We have tried running the Duplicate Agent GUID task but that did not solve the issue. We manually delete the duplicates but when the AD sync occurs the same systems are duplicated.

[cdinet · Accepted solution]

The duplicate guid task doesn't remove duplicate systems.  What that is designed to do is deal with systems that have duplicate agent guids (high sequence errors) and it instructs the agent to regenerate its guid.  It has nothing to do with actual duplicate entries in the console. 

For AD sync duplicates, what version epo are you on?  Are you doing any forceinstalls of the agent?  If so, that can create duplicates.  There is an issue with some versions of epo that can cause that.  See kb89427.  

If none of that applies, try deleting both entries from epo, then do the AD sync and let the agent check back in on its own.  It should then update that unmanaged entry with its props.

[hugo2069]

We are running on ePO 5.9.0. We have performed many forceinstalls but have never had the issue.  Looks like 5.9 has an issue that was fixed in 5.9.1.  We will need to look into upgrading to that version.

[cdinet]

If you are going to upgrade, I would suggest going to 5.10 if possible, as there won't be any 5.9.2 release. 

[hugo2069]

Thank you.

[JKBH1]

Hi cdinet,

We are running into this problem. We are on:

ePO Build: ePolicy Orchestrator 5.10.0 (Build 2428)
Update Installed: Update 6 (2.0.0.831)

We do not use forceinstalls on the agent so KB89427 is not applicable to our environment.

What do you mean by "deleting both entries from ePO"? Can you please send a guide or link on how to follow this process? Also, you mentioned AD sync--- how do we handle our Mac devices that cannot rely on AD sync as it doesn't use AD?

We have 3000+ systems, is there a way to automate the deletion? 

Thank you.

[Hey_Dave]

Simply delete all of the entries for the duplicated systems from the System Tree (don't check box to remove agent), then wait for the agents to check back in. They will be recreated (as one entry per system) in the system tree with the correct properties. Then you will need to move them from the Lost and Found into the correct System Tree container(s).

With this method it doesn't matter what your OS is. And you don't need to kick off an AD sync. You simple have to be patient. How soon they check back / get recreated will depend on how often you have configured them to check in, and where they are in their check-in cycle. 

Remember, even though you have removed them from the System Tree, the Agents will still hold their known policies until they check in and receive different policies. If you have vastly different policies for your Lost and Found than you do for your production containers, then you may want to watch closely for them to repopulate. (Perhaps do this at a time of low user impact.)

[tucker84]

I have the same issue with a larger subset using ePO 5.9.1

From what I can see the duplicate entries are mostly blank with just an AD description. Is that similar to what you have for an issue?

[cdinet]

Are the same systems duplicated?  What version of the agent?  When you see it duplicated, do you see anything in the agent log regarding the uuid changing and it generating a new agent guid?  That would be in the masvc log in c:\programdata\mcafee\agent\logs folder.  Are these physical or virtual systems?  

[JKBH1]

Running the Duplicate Systems Names query, data shows that most are on agent version 5.6.2.209 and below 800 devices are still on older agent versions.

Some of the system names are the showing the same hostnames. Digging into the properties section - one is running Windows and the other duplicate system is running Mac so these are two different devices. And they have different user names. However, some that are showing the same hostnames have exactly the same operating system and user name--- so these are the same devices.

Regarding your question if these are physical or virtual systems, is there a criteria or property to use? I only see VDI and when I use that, my data shows that these are not VDI systems.

As for the logs, can this be gathered through single system troubleshooting (no need to engage user to send it us)?