SEP clients change from computer mode to user mode. Also appears in a different SEPM folder.

[Migration User]

Hi,

We facing a really different issue right now. We have installed over 45 000 client with SEP 11 in different ways, SMS remote installation exported exe files without any big issues. The environment is well managed but suddenly the clients we install appears in users mode. They all appear in one group that isn’t the default group and therefore don’t get the correct policy files etc (if we look into the sylink.xml file at the new installed client it point to the correct group). We have an open case with Symantec but so far no useful information. Have any one else seen this issue? This is on SEP 11 MR3 we will upgrade as soon as possible to SEP 11 MR4 MP2 but everything we have seen so far is indicating something that is wrong with the SEPM we have reach some limit and then it’s freaking out…

Have anyone any idea on what happen ?

Also we have 500+ clients installed in user mode (before we was able to stop the rollout) that we manually need to change to computer mode, one at the time. Any idea on how to change more than one user/computer at the time.

/Stickan

[Migration User]

I think you might also have a replication setup here
This happned because of that what you can do here is delete all the clients from the manager that are point to wrong group in usermode & they should report back fine
You can also upgrade to MR4 & then to Mr4 MP2 to get a permanent fix for this
( NOTE:- All your clients & SEPM should be on MR4 MP2)

[Migration User]

I'm not sure that I understand you. What do you mean with a replication setup?
The SEPM is on MR4 but the clients is on MR3. Will an update of the SEPM to MR4MP2 solve this even if we have clients on MR3?

Thank you for you answer.

/Stickan

[pete]

Any idea on how to change more than one user/computer at the time.
search the user in the client tab for users and then select all users and change to computer mode.

[Migration User]

By replication I mean you have two defferent sites ( SEPM MANAGERS) with two different database but sharing the same information.
No I think you will need all your clients & server to be on MR4 MP2

[Migration User]

We facing same issue a bank account . We installed about 25.000 clients. All servers and clients installed MR4 Mp1a .
we will upgrade the servers and clients to MR4 MP2 ? Is this definite solution ??

[Migration User]

We facing same issue a bank account . We installed about 25.000 clients. All servers and clients installed MR4 Mp1a .
we will upgrade the servers and clients to MR4 MP2 ? Is this definite solution ??

[Peterpan]

I hope this issue will resolve in the latest MR, we'll wait unitl september to see if this issue has been resolve

[Ramji Iyyer]

We have also faced this issue when we have upgraded to MR2.MP2 but continued till MR4. After upgrading to to MR4.MP2 this resolved.

As you have mentioned that u have 4 SEPM servers. Kindly do the following.

Upgrade the server to MR4.MP2.

Delete the replication & remote sites from all the servers

Stop the SEPM services on all the servers

Run the batch file to change to computer mode. on all the servers simultaneously.

Run the batch file fix duplicate clients. on all the servers simultaneously.

Start the SEPM Services on all the servers.

Add replication partners of all the servers fron Parent server.

Do the replication of all the servers one by one.

Note:- This is a BUG of SYMANTEC.  I knew that the symantec employess who contaced me for solution are very much known to this issue.
             

Regards...
Ramji Iyyer

[Ramji Iyyer]

https://www-secure.symantec.com/connect/idea/changing-clients-usermode-computer-mode-batch-file


Regards...
Ramji Iyyer

[Migration User]

I don’t know what to say but this seems to be back in the new patch release 11.0.5.002.333. We now facing a really mess in our environment 20 % of our client is in user mode and in wrong group. Is there anyone else that have the same critical situation?

/Stickan

[Migration User]

I'm not sure if I'm having the same issues, but I am definitely experiencing some problems...

 

We have the following versions of Symantec:

 

Server = Symantec Endpoint Protection Manager V. 11.0.5002.333 Computers = Symantec Endpoint Protection V. 11.0.5002.333

 

Issues:

 

1. When a newly imaged computer is connected to the network, it is apparent, from the computer, that it is communicating with the server (i.e., shield in task bar has green dot, server name and or IP appears in the "troubleshooting" window). However, in the same "troubleshooting" window, under "Management> General Information>Group, the clients appear in random groups. When I search for the clients on the AV server, they do not exist.

 

2. On the "Action Summary by Number of Computers" Symantec is reporting a virus on a computer. When I open the window to see the computer's information the following occurs:

 

It reports the following information: Computer, User, and IP Address > Risk > Risk Count > Status Last Updated > Domain Server Group > File/Entry.

 

However, when it refreshes the "Computer, User and IP Address" keeps switching between two random computers (which do not have a virus). The File/Entry remains the same. The profile listed in the entry (i.e., C:\Users\profile.name\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\xxx.xxx) does not exist in either of the random systems.

 

However, when I look at the logs of the computer, for which the profile exist, it does indicate that a virus was detected. But, when I search for the computer on the AV server, it does not exist.

 

I am requesting assistance in determining the cause of these issues.  Thanks!

[Migration User]

I was faced with phenomena such as JoseO.
The same version (RU5).

RU5 first installed SEPM & MR4 upgrade to the RU5 commonly found.

Give me solution.

[Migration User]

If you are searching for a computer (by name) and you can't find it, chances are that it has ended up in User Mode.

To find all computers that are in User Mode do the following:

Go to Client Tab -> Right-click:  "Search Clients"

Change the "Find:" dropdown box in the upper left corner to "Users".

Change "Search Field" to "Logon Computer Name" and "Comparison Operator" to "LIKE"

Leave "Value" empty and hit the Search button. This returns a list of everything in User Mode.

[Migration User]

we are definetly experiencing it and we are on version  11.0.5.002.333

[Migration User]

Possibly same problem here. Still looking for a solution.

[Migration User]

Hi.

For those looking for the batchfile that does the automatic change of clients from user mode to computer mode, it is available on the latest MR6a installation DVD.

The script is now in VBS format and is located in.

\Tools\NoSupport\MoveClient_Utility

Attachment(s)

MoveClient_Utility_0.zip   1.55 MB 1 version

[Migration User]

Dear Ramji.

You talk of a batch file to fix duplicate clients. Where can we get a copy of that file?

[Migration User]

Beware this utility!

This is from the RU6 DVD as described above and the ReadMe file says it is compatible with RU5. I've run it twice on our SEPM server and received this error:

Unable to communicate with the reporting component after logging into the Symantec Endpoint Protection Manager

That means it's Repair / Re-install on RU5.

[Migration User]

This attached batch file with MoveSwitchDbFix.jar (Java Archive) fixes my problem nicely.

 

No more user objects. Will have to wait & see if they come back.

Attachment(s)

SwitchUserModeToCompModeTool.zip   113 KB 1 version

[Migration User]

Hi.

Another way is to Set Display Filter in the Tasks section on the Clients screen. This gives you the benefit of working normally and not being restricted to the Search results box. Remember to change this back when finished.