How to prevent Windows Altiris agents from creating specific uniqueid resource keys

Products

• IT Management Suite

Issue/Introduction

 

Resolution

In some rare instances the Symantec Management Agent (Altiris agent) on multiple Windows computers may submit the same uniqueid resource key to the Symantec Management Platform (SMP) server and in turn get the same GUID. This causes the effected computers to share a GUID, which causes a variety of issues.

When an agent requests a GUID from the server the agent sends one or more resource keys to the server. These resource keys contain certain details about the managed computer. The server checks whether any of the submitted resource keys are already associated with a GUID in the database. If a GUID is found, the found GUID is returned to the agent, otherwise the server creates a GUID and the returns the created GUID to the agent.

On Microsoft Windows computers, the agent may submit uniqueid resource keys. These resource keys are a combination of the Computer UUID, the Motherboard serial number and the MAC address of one of the network adapters. On computers with multiple network adapters the agent may submit multiple uniqueid resource keys. For information about resource keys see:
   Resource Keys used by Notification Server and other Components/Solutions
   http://www.symantec.com/docs/HOWTO10136


Starting in later versions of Altiris 7.1 sp2 and continuing in Altiris 7.5, an agent will not submit uniqueid resource keys based on MAC addresses specified in the Windows Registry key:
    HKLM\Software\Altiris\Altiris Agent\Inventory\ExcludeMACFromUniqueKeys

To see what MAC addresses are already excluded run the command:
   reg query "HKLM\Software\Altiris\Altiris Agent\Inventory" /v ExcludeMACFromUniqueKeys

To specify MAC addresses to the registry key, run a command similar to:
   reg add "HKLM\Software\Altiris\Altiris Agent\Inventory" /v ExcludeMACFromUniqueKeys /t REG_MULTI_SZ /s ";" /d "00-50-56-05-41-76;00-BB-20-52-41-53"


Addressing Shared GUIDs

Preventing Shared GUIDs
For more information about how GUIDs may come to be shared and how to prevent this from occurring see:
   How to Prevent Shared GUIDs
   http://www.symantec.com/docs/HOWTO93988

Detecting Shared GUIDs
For an Altiris report and an SQL query to see which computers appear to be sharing GUIDs and which will be removed using the process below, see:
   Detecting computer with Shared GUIDs
   http://www.symantec.com/docs/HOWTO49693


Technical Background:

To see a Windows computer's UUID and mainboard serial number, run the commands:
   wmic path Win32_ComputerSystemProduct get UUID /value
   wmic path Win32_BaseBoard get SerialNumber /value

To see a list of a computer's network adapters, including MAC addresses run the command:
   wmic path Win32_NetworkAdapter get Name,MACAddress,AdapterType,PNPDeviceID /value

Note, uniqueid resource keys are created for some, but not all, network adapters with MAC addresses.


ULM (Unix, Linux Macintosh) Computers

An agent on a ULM (Unix, Linux Macintosh) computer submits slightly different resource keys. But may experience a similar issue, see:
   Configuring the SMP Agent to ignore specific resource keys on Unix, Linux & Macintosh clients
   http://www.symantec.com/docs/HOWTO60919