System got Deleted from ePO

[Former Member]

Hello.....

I have faced one Issue in Epo, as 1 of the Systems got removed from epo & i found no entry logged in Audit Logs.

Anyone can help me in this...

Thanks in Advance.

[Former Member]

Can any one help to find When & How the Systems got Removed from ePO, I have checked Audit logs & Agent Uninstalls Attepmts Query but unable to find any Entry for that Particular system.

[apoling]

Hello,

First reasonable guess would be a regular maintenance server task which deletes inactive agents (for systems that got their agents uninstalled by whomever/whatever).

Second would be also a server task, named Duplicate agentGUIDs - remove systems with potentially duplicated GUIDs (this is more likely to happen I would say).

(there can be more, though)

However I cannot say these should be shown in the Audit Logs as I am not sure of it.

Attila

[Former Member]

Hello Attila.

Thanks for ur reply, Sorry to say that in my last post i forgot to mention that we havent configured any Server Task to Delete Systems.

[jstanley]

By far the most common reason I've seen this occur is duplicate MAC addresses and the solution (if that is the root cause) is documented in KB52949.

EPO uses the following algorithm to match up properties packages sent up by clients to entries in the system tree:

1- Agent GUID

2- MAC address

3- System name

Once it finds a match in the above algorithm it exits. So if for some reason multiple machines are reporting the same MAC address (VPN clients will often report the MAC address of the VPN concentrator or VM machines may not have had the MAC address reset when they were cloned) and just one of those machines don't have an entry in the system tree already on thier first agent-to-server communication it will overwrite another machines properties. Then when the machine that just had its properties overwritten communicates in it will in turn overwrite another machines properties. The KB article essentially has you write the vendor ID for the duplicate MAC to the DB on that MAC address will then be ignored for matching purposes.

Here is a query you can write to spot this:

1. Logon to ePO
2. Select Menu | Reporting | Queries | New Query
3. Select System Management | Managed Systems | Next
4. Select Singe Group Summary Table
5. In the Labels Are: drop down list select MAC Address under Computer Propertes | Next
6. Add Mac Address as a Selected Column | Next
7. Select Managed state equals true as a filter | Run

You should have a list of mac addresses with a count of the number of systems reporting that MAC address. Ideally it would be a 1-to-1 ratio. If you have more than 1 system sharing the same MAC address then this is problably your issue.

[Former Member]

Hello Jstanley.

Thanks for your Reply...may i know what to do if i found more than 1 system sharing the same MAC Address??..............

[rackroyd]

Also, AD-Synch tasks may remove as well as add machines - if the machine were removed from AD this might be reflected in the ePO system tree after.

Rgds,

Rob.

[Former Member]

Hello Rackroyd.

Thanks for your reply....this is to Update you that Systems was not removed from AD,

Have you gone through the Post which was posted by Jstanley....thats sounds pritty good, but i want to know i thing, may i know what to do if i found more than 1 system sharing the same MAC Address??..............

[apoling]

Would you please tell us the ePO server version (I have the impression this might affect the answer to your query).

Thanks.

Attila

[Former Member]

Hello Attila.

McAfee ePO 4.5 Patch 4 Hotfix 1