Endpoint Protection

Hi,

On the SEPM manager's Home page,the actual number of clients is not shown.But in the clients' page,it is shown properly.[So far 2337 computers are installed with SEP,but suddenly,the home page summary says there are just 402 clients.] If I extract a quick report for the past week it gives,the actual no.of clients but the same reads just 402 clients if the time range is specified as past day.Can anyone give a fix for this......

[We have restarted the Symantec Settings manager Services too,still no go]

Regards,
Monica

Hi,

What is the version of SEPM you have installed?

Alsol, please delete the contents of the agentinfo folder in SEPM.

1. Stop the Symantec Endpoint Protection Manager service
   
   1. Click Start, then Run
   2. Type services.msc
   3. Click OK
   4. Locate and right-click Symantec Endpoint Protection Manager in the list, then click Stop

       

2. Open Windows Explorer and navigate to the following folder; back up all files residing in this folder before proceeding:

   \Program Files\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo

3. After backing up the files, delete the contents of the folder so that the agentinfo folder is empty
4. Start the Symantec Endpoint Protection Manager service
   
   1. Click Start, then Run
   2. Type services.msc
   3. Click OK
   4. Locate and right-click Symantec Endpoint Protection Manager in the list, then click Start

       

5. Log into the Symantec Endpoint Protection Manager

Aniket

Hi,

The verion of the SEPM is 11.0.5002.333.Also can we proceed with the above suggested step,is there any risk involved in this,as the server is a very critical one.Also we are yet to deploy SEP on 11,000 more clients that are in the n/w.This server will be the primary SEPM with a secondary one as redundant.Hence please advice,whether to go ahead with the above step....or is there any other alternative....

Not much info to go on in your post, but:

Have you checked your logs closely to see that your clients are, in fact, on-line?
Are you entirely sure that 402 isn't the correct number?

Your home page only shows the number of clients who have checked in with SEPM in the last 24 hours. It does not list the total number of clients.

So, if you have large number of mobile clients who are out of the office, or (for that matter) a problem with clients, network, or some weird setting, the discrepancy could be explained that way.

I agree with reedmohn about " shows the number of clients who have checked in with SEPM in the last 24 hours. It does not list the total number of clients."
The data on  your screenshot shows that there could be problem or simple just either your mobile clients were offline or their AV is not working.
 

So how do you find out exactly how many clients you have out there? 

We've pretty much finished rolling out SEP to the entire school district, but the numbers still seem low.  We're expecting about 26k todal, but the highest i've seen was last friday at just shy of 21k.  Early monday morning (today) it was only at 12k, and over the last hour it's jumped to 14.5k. 

We'd really like to know what sort of coverage we have out there.  Altiris NS gave us pretty good inventory numbers after we finished rolling it out, but it seems SEPM should be able to give us even more accurate numbers pertaining to SEP, and in real time.  Our environment is so big, we have to stagger inventory collection in Altiris so that it happens over the course of a week.  We want better resolution than that, and it seems SEPM ought to be able to provide that. Right now the only way i can think of to find out would be to directly query the db, and without knowing much about the table structure, i can't do that.

we're on version 11.0.5002.333, and it was not an upgrade from anything - we started from scratch with 5 brand new servers (2 sql, 3 sepm) and used altiris NS to push sep to our clients, most of which had SAV 10.x.

btw - this isn't an issue of mobile clients and such... this is a K-12 school district with less than 1% of them being laptop users, and of those, a large chunk of them simply leave them in their docking station 100% of the time - they may as well just have a desktop pc.  no, the computers aren't all on all the time, but i rather doubt that nearly a third of our computers are turned off for more than 30 days at a time (we have SEPM set to delete clients when they haven't checked in within 30 days). 

also worth noting...

when running the report to show computer status/computers not checked into server over the past month, it returns zero rows.  we've had sep since the end of march.  surely in an environment this size, there's at least ONE that hasn't checked in lately...

If you want a total client count go to:

Reports -> Quick Reports -> Report Type: System -> Select Report: Site Status ->Create Report

Should give you total installed clients as well as total online clients.

In my experience, zero's means your logs are not there.

Make sure that you retain logs long enough.  Check both log age and size settings.

Gibson, just a quick note from your posts...

"when running the report to show computer status/computers not checked into server over the past month, it returns zero rows."

In the previous post you stated: "(we have SEPM set to delete clients when they haven't checked in within 30 days)"

That could be why you aren't seeing anything when you run that report. I may be mistaken, but I believe once the clients are deleted, their log entries are as well. Try running the report for "past week" instead of month, and see if you get any results returned.