Duplicate client is generated each time Endpoint Protection or the system is restarted
search cancel

Duplicate client is generated each time Endpoint Protection or the system is restarted

book

Article ID: 164939

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Each time the system or Symantec Endpoint Protection (SEP) is restarted, a duplicate of that client shows up in the Symantec Endpoint Protection Manager (SEPM). This only happens on machines with many drives (~15+).

No errors are seen, just duplicates of the same client in the SEPM.

Environment

The computer has many drives listed, ~15 or more.

Cause

Symantec Endpoint Protection generates a unique hardware ID for each client when SMC starts. This is stored locally so the client will remember it's hardware ID. This can change if the hardware in the client changes. There is a limit of 20 hardware components that the client currently looks at which can result in duplicate clients being generated if the machine has a lot of drives resulting in more than 20 hardware components being present.

Resolution

To allow the SEP client to recognize all of the hardware in the machine and stop generating new hardware ID's due to the amount of drives, set the following registry key:

Create and set "MaxSystemIDs" (DWORD) to a value greater than the hardware components in the system, 40 (Decimal) should be enough for most systems.

32-bit OS: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\MaxSystemIDs = 40
64-bit OS: HKLM\SOFTWARE\wow6432node\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink\MaxSystemIDs = 40
Reboot after this key is set.