Duplicate entries in the embedded database (DB) exist for a computer after formatting.

Products

• Endpoint Protection

Issue/Introduction

Scenario:

A client computer has Symantec Endpoint Protection (SEP) installed and is in contact with the Symantec Endpoint Protection Manager (SEPM). The client computer is then reformatted. During the re-installation of Windows, the hostname of the machine is set back to the hostname it was before the format, and the same static IP is assigned to the machine. After deploying SEP to this machine again, the client now shows up twice in the SEPM. One entry is current, the other shows as offline (and may also show other negative results, such as an infected status), which cannot be corrected.

What can be done to prevent these duplicate clients?

Symptoms
Duplication of the same machine's data repeated in the SEPM console.

 

Cause

Each time a SEP client is installed, the SEPM console creates a unique ID for the client, even if the hostname and IP address of the client is the same as before. Because of this, it's possible for clients to be duplicated in the lists, as the "new" machine and the "old" machine have different IDs, and, as such, are treated as separate computers.

Resolution

Remove the client from the SEPM before SEP is reinstalled on the machine. However, if the client is not removed prior to reinstallation, the "old" client will drop off after the SEPM reaches the configured limit of idle time to drop clients (usually 30 days).