Managing Microsoft Hyper-V VDI with Symantec Management Agent

Products

IT Management Suite

Issue/Introduction

You may have noticed that multiple Microsoft Hyper-V Virtual Desktop Infrastructure (VDI) machines—both persistent and non-persistent—are receiving the same Resource GUID from the Symantec Management Platform (SMP) Server. This behavior causes the machines to overwrite each other in the SMP Console, preventing you from managing multiple VDI instances simultaneously.

Environment

IT Management Suite (ITMS) 8.7.3 and higher

Cause

The primary reason for duplicate GUIDs in a Hyper-V VDI environment is the duplication of the Trusted Platform Module (TPM) ID. When VDI machines are cloned from a "generalized" sysprep template on a Hyper-V host, they often inherit and share the same virtual TPM (vTPM) identity. Because the Symantec Management Agent (SMA) uses hardware-bound identifiers like the TPM ID to generate a unique Resource GUID, identical TPM IDs lead to identical GUIDs.

The issue stems from a non-unique Virtual TPM (vTPM) ID assigned to cloned virtual machines:

TPM Sharing: You might notice that VDI machines share the TPM module from the host, resulting in identical keys.
GUID Generation: The SMA incorporates the tpmid value into the algorithm used for machine identity.
Cloning Limitations: While manual VM creation on Hyper-V typically results in unique IDs, automated VDI cloning from a generalized template does not always reset the TPM identity.

Resolution

To successfully manage Hyper-V VDI machines, each instance must have a unique identity. Follow the guidelines below to ensure proper communication with the SMP Server.

1. Support Requirements for VDI

To manage Hyper-V VDI with ITMS 8.7.3 and later, you must ensure one of the following conditions is met:

Unique vTPM IDs: Each VDI machine must have a unique vTPM ID
Disabled TPM: If unique vTPM IDs cannot be generated, you must disable the TPM on the machines to allow the SMA to work successfully with the SMP.

2. Creating the Gold Image (Template)

Starting with ITMS 8.7.3 and later, the Symantec Management Agent and solution plug-ins can be installed on Hyper-V VDI systems (both persistent and non-persistent), allowing those VDIs to be managed by ITMS.
A gold VDI image can be created with the Symantec Management Agent and required solution plug-ins already installed. Any persistent or non-persistent VDI machines created from this image will come up with the agent and plug-ins in place and automatically connect to the appropriate ITMS server when they are powered on.

Step	Action	Description
1	Prepare OS	Install Windows 11 on the base VM and install the SMA and solution plug-ins.
2	Configure TPM	Recommendation: Disable TPM and Encryption on the Gold Image template.
3	Generalize	Perform a generalized sysprep for this main image.
4	Clone	Deploy VDI instances from this template.

Notes:

ITMS supports persistent and non-persistent VDI systems as managed clients only when each VDI has a unique TPM ID. If multiple VDIs share the same TPM ID, they will overwrite each other in ITMS because they end up with the same Resource GUID.
Multiple persistent or non-persistent VDIs can be managed at the same time if TPM is not enabled on those machines.

3. Verification & Validation

To confirm that the machines will receive unique GUIDs:

Check TPM ID: Compare the tpmid value reported by two different VDI instances. Use one of the methods in “How to view the tpmid value” below. If the values match, the instances share a vTPM ID.
- Example entry:
  <key name="tpmid" value="UcBJGlgW+..." />
Monitor SMP Console: Ensure both machines appear as distinct resources under Manage > Computers.
Agent Logs: Review logs in C:\ProgramData\Symantec\SMP\Logs (e.g., aXX.log) for registration events to ensure no identity collisions are occurring.

How to view the tpmid value

Use one of the following methods to view the tpmid value for each VDI instance. Method A runs on the VDI. Methods B and C run on the SMP Server.

Method A: Capture the basic inventory NSE on each VDI

On the first VDI instance, open Registry Editor.
Navigate to HKEY_LOCAL_MACHINE\Software\Altiris\Altiris Agent\Transport.
Modify the String value Capture Events Folder so the Value data points to a folder, for example C:\Temp.
Send basic inventory from the VDI instance.
Open the captured NSE file in that folder and locate the tpmid resource key.
Repeat steps 1–5 on the second VDI instance and compare the two values.
Remove the value from Capture Events Folder after testing. Captured NSEs eventually consume significant disk space.

Example tpmid resource key in a captured NSE:

<key name="tpmid" value="xxxxxxxxxxxxxxxxxxxxxxxxx+6qbwaY="/>

For more detail, see Capturing NSEs on a Windows client.

Method B: Query the SMP database

Run the following query against the CMDB to list computers that share a tpmid:

SELECT 
    i.Name AS [ComputerName], 
    rk.ResourceGuid, 
    rk.KeyName, 
    rk.KeyValue
FROM vItem i
JOIN ResourceKey rk ON i.Guid = rk.ResourceGuid
WHERE rk.KeyValue IN (
    SELECT KeyValue 
    FROM ResourceKey 
    WHERE KeyName = 'tpmid' 
    GROUP BY KeyValue 
    HAVING COUNT(*) > 1
)
ORDER BY rk.KeyValue, i.Name

If two different computer names appear for one KeyValue, those resources are merging.

Method C: Review NS logs with Trace verbosity

Turn on Trace verbosity on the SMP Server. See Configuring logging on the Notification Server and an Altiris Agent computer.
Open the NS logs in C:\ProgramData\Symantec\SMP\Logs\aXX.log.
Search for entries with the source Resource.DetectDuplicateItems. A duplicate entry lists the resource keys, including the tpmid value.

Example log entry:

Duplicate resource found (Duplicate): 'Computer10050' (1d94f159-ac0a-40b6-8fbd-a23b4b0b202c),
...
[tpmid]=[MHUTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxPPP/6K=]
...
Source: Resource.DetectDuplicateItems

Interpreting the results

Result	Interpretation
The `tpmid` values on the two VDI instances are different	Each VDI has a unique vTPM ID. The machines should receive separate Resource GUIDs.
The `tpmid` values on the two VDI instances are identical	The VDIs share a vTPM ID and will overwrite each other in ITMS. Correct the template, or disable TPM as described in Section 1.
The SQL query returns both VDI names under one `KeyValue`	The resources are already merging on `tpmid`. See Virtual Computer Resources Merging Unexpectedly Due to Duplicate TPM Identifiers (tpmid) in ITMS 8.7.1 and Later for cleanup and the temporary merge mitigation.