Computer Resources Merging or Resetting GUIDs Due to Duplicate MDM Device IDs (wmdm_device_id)
search cancel

Computer Resources Merging or Resetting GUIDs Due to Duplicate MDM Device IDs (wmdm_device_id)

book

Article ID: 271514

calendar_today

Updated On:

Products

Client Management Suite Server Management Suite IT Management Suite

Issue/Introduction

You have several machines in just ONE location that are resetting GUIDs continuously.  These machines seem to have duplicate GUIDs.

You have uninstalled and reinstalled the Altiris Agent (as well as cleaning the registry) on three different machines and this is still happening.  

 

NS logs show:

Host Resource <GUID of Computer> shares GUID with another machine: HOSTNAME.domain.COM. The resource must change its GUID

Add duplicate computer resources to the blacklisted hosts' list 

 

--SQL shows merging on wmdm_device_id

SELECT 
    rk.KeyName,
    rk.KeyValue,
    COUNT(DISTINCT rk.ResourceGuid) AS ResourceCount
FROM ResourceKey rk
GROUP BY rk.KeyName, rk.KeyValue
HAVING COUNT(DISTINCT rk.ResourceGuid) > 1
ORDER BY ResourceCount DESC, rk.KeyName

Environment

ITMS 8.7.x, 8.8.x

Cause

Preconfigured MDM registry setting on newly added computers causing merging based on wmdm_device_id resource key.

The "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\MDMDeviceID" key is a unique Mobile Device Management (MDM) device identifier. It is expected to be different for each device.

The SMA reports the MDM device identifier to the SMP Server as the wmdm_device_id resource key. If two machines report the same wmdm_device_id value, the SMP Server treats them as the same resource. Example resource keys from a captured NSE:

<key name="fqdn" value="computer.example.com"/>
<key name="name.domain" value="computer.example"/>
<key name="name.domain" value="computer.example.com"/>
<key name="uniqueid" value="123456789JdBovg=="/>
<key name="wmdm_device_id" value="xxxxxxxxxxxxxxC26C37B9AB"/>

This typically occurs when an image is captured from a machine that was already enrolled in MDM.

Resolution

To confirm that wmdm_device_id is the cause, check the SMP logs, the database, and the affected clients.

Log analysis

  1. Turn on Trace verbosity on the SMP Server. See KB Configuring Advanced Logging for Notification Server and Symantec Management Agent.
  2. Search the NS logs (C:\ProgramData\Symantec\SMP\Logs\aXX.log) for entries with source Resource.DetectDuplicateItems.
  3. In the Duplicate resource found entry, look for the [wmdm_device_id]=[...] line. Compare its value with the duplicate resource listed in the following Resource.HandleDuplicateItems entry.

Without Trace verbosity, the existing log entries in this article (shares GUID with another machine and Add duplicate computer resources to the blacklisted hosts' list) confirm the symptom but don’t name the key.

Client-side check

  1. On an affected machine, open Registry Editor (regedit).
  2. Look for:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\MDMDeviceID
  1. Note the MDMDeviceID value.
  2. Repeat on a second affected machine. Matching values confirm the cause.

You can also capture the basic inventory NSE (KB Capturing NSEs on a Windows client) and compare the <key name="wmdm_device_id" .../> entries.

Recommendation 1: Remove the duplicate MDM device ID 

Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\MDMDeviceID on devices in the newly added site/location.


Recommendation 2: Correct the imaging process

Make sure to review your imaging process to ensure a clean, un-enrolled image is deployed without MDMDeviceID key. After deploying the image, they may re-enroll the device to generate a unique MDM identifier.

Recommendation 3: Prevent merging based on wmdm_device_id (temporary mitigation)

If duplicate wmdm_device_id values exist and you can’t remove them right away, configure SMP Server to stop merging on this key.

NOTE: This is the same approach KB Virtual Computer Resources Merging Unexpectedly Due to Duplicate TPM Identifiers (tpmid) in ITMS 8.7.1 and Later documents for tpmid.

Option A: Resource Type Keys (recommended)

    1. Navigate to: Settings > Resource and Data Class Settings > Resource Type Keys
    2. Locate Resource Type: Computer.
    3. Find the key wmdm_device_id.
    4. Edit the key.
    5. Set Merge Resources = No.
    6. Click OK.

Option B: Core Settings

Configure the following Core Settings (KB Updating Core Settings in ITMS 8.5 and later):

    • ComputerResourceMergeSettings = 2
    • ComputerResourceKeyFilter = wmdm_device_id

See KB Understanding ComputerResourceMergeSettings and ComputerResourceKeyFilter in ITMS for how these two settings behave. Treat this as a temporary workaround. The root cause is a duplicate MDM device ID in the image, and it must be fixed there.

Recommendation 4: Clean up affected resources

After removing the duplicate MDMDeviceID, confirm the affected GUIDs are in the AgentBlacklist table and let the clients check in to get new GUIDs (see KB Client Machines are sending same UniqueID during Basic Inventory).


Verification

  1. Confirm each affected machine appears as a separate resource in the Console under Manage > Computers.
  2. Watch the NS logs for 24 hours. No new shares GUID with another machine entries should appear for the affected machines.
Powered by Wolken Software