Detecting computers with Shared GUIDs

Products

• IT Management Suite

Issue/Introduction

 How can I find computers that possibly have a shared GUID situation going on.

Environment

ITMS 8.x

Resolution

 A GUID is shared when two or more Symantec Management Platform (SMP) agents are using the GUID at the same time. This can cause some fairly odd behavior.

To check for shared GUIDs, run the attached SQL query, and review the results; or import the attached Altiris report into the Altiris console, run the report and review the results. The attached Altiris reports is based on the attached SQL query which is based on the query used in the SQL script used TECH212345, mentioned above.
The Altiris report has the additional feature that right-clicking on any row brings up a context menu for the particular Computer GUID.

When looking at the results of the report, keep in mind that we look at name changes to identify possible shared GUIDs. Computers that were recently renamed or imaged may show up on the report even though they don't necessarily have a shared GUID.  To identify shared GUIDs, look for GUIDs on the report that have multiple names in the Key Value column that should represent separate resources. To confirm if two or more computers are using the same (shared) GUID, connect to those computers and check the SMP agent's GUID. This can be done using the SMP Agent UI, or using the Remote Altiris Agent Diagnostic (RAAD) tool, see:

Remote Altiris Agent Diagnostics (RAAD) 2.0,
https://knowledge.broadcom.com/external/article?articleId=172007 

Query results details:

Field	Description
GUID	the computer GUID
Name	the current computer name associated with the GUID, not very helpful
IsManaged	1 if computer is managed (e.g. has an Altiris agent installed), 0 otherwise
IsBlacklisted	1 if computer GUID has been blacklisted, 0 otherwise
KeyAdd Count	number of times the value of this key was set (for this GUID, during the time period) Did the change a few times, and you can explain why it changed that many times? Or, did the value change too many times for explanation?
KeyAdd Date Range	first time and the last time this key value was to any value (for this GUID, during the time period) Did the name change on just one day? Or did it change on multiple days?
h	number of unique host name values (extracted from KeyValue field) Is there just one host name, such as when the computer joined the domain? Is there just two host names, such as when the computer was actually renamed? Is there many host names, as if the GUID is being shared.
d	number of unique domain name values (extracted from KeyValue field)
t	number of unique values for the "name.domain" field
KeyValue	one value to which this key was set (for this GUID, during the time period) Note: Multiple KeyValues are shown on sequential rows.
ValueAdd Count	number of times this resource key was set to this value (for this GUID, during the time period)
ValueAdd Date Range	first time and the last time this key value was to this value (for this GUID, during the time period)