Endpoint Protection

 View Only
Expand all | Collapse all

Clients stuck or duplicated in Default Group

Migration User

Migration UserJan 21, 2010 11:00 AM

Migration User

Migration UserJan 21, 2010 11:17 AMBest Answer

  • 1.  Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 08:56 AM
    SEP 11.0.5

    I have read many articles regarding clients stuck in the Default group and not in the appropriate OU -- I have tried many of the things mentioned but cant get my clients to move to or show up in the correct OU -- I have tried: sync now, refresh, moving the client to a different OU in AD, etc...

    It seems to happen with new installs or re-installs on existing systems.  I have several systems where the "old" client shows up in the correct OU (with no green dot) and then also appears in the default group (with a green dot).  I can delete the clients in the default group (can't delete clients in OUs) but they reappear as soon as they contact the SEP server.



  • 2.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 09:07 AM


    Have you checked this article 

    Managed Symantec Endpoint Protection (SEP) Client appears in Default Group instead of Active Directory Organizational Unit (OU) in the Symantec Endpoint Protection Manager (SEPM)

    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009090119133848


    Try importing only the OU's and then see whether that makes a difference

    http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092721431648


  • 3.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 09:32 AM
    The clients endup reporting to the 'Default group' only if there is something wrong with their actual group... In your case, there is an entry( an offline entry, to be precise ) in the OU group.. You cannoy delete or move clients from a OU group and also there cannot be multiple entries of same host under same group, that's why the clients end up in default group.

    * You will have to clear the stale entries of the clients from the database and let the client register with the SEPM again. This would hopefully address the issue... :) .. Let us know if things are not clear...


  • 4.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 11:00 AM
    Yes - saw those articles, didnt fix my situation


  • 5.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 11:02 AM
    That does make sense since Im seeing some duplicates - how do I clear stale entries from the db


  • 6.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 11:09 AM

    Try this dude....

    1. Navigate to SEPM\ASA\Win32 and run dbisqlc.exe

    2. That will give you a window similar to ODBC config.

    3. Provide all the needed information:

    Username : DBA
    password: password of admin account you chose during install.

    source : Symantec DSN

    * In the Database tab, provide the server name as SPC_server's name (since its RU5, you have to preceeed the server's hostname by SPC_ )

    * Database name is 'Sem5'

    * And for database file, browse and choose sem5.db under SEPM\db\sem5.db
    ( Care should be taken to point to right sem5.db.... as there will be another sem5.db under asa folder)

    * Click on Okay

    4. If the information given are correct, it will open up a Interactive SQL.

    5. In the execute window, type the following query ...For testing, lets take one of the affected client

    SELECT * FROM SEM_CLIENT WHERE COMPUTER_NAME='name of the affected client'

    This would give you the entries of that client in the DB ... Now, if you see more than onr entry for same client... you can delete the rest by the following query...

    DELETE FROM SEM_CLIENT WHERE COMPUTER_NAME='affected computer' AND DELETED='1'


    Note : Please try with one test client and lets see how it goes...



  • 7.  RE: Clients stuck or duplicated in Default Group
    Best Answer

    Posted Jan 21, 2010 11:17 AM
     Delete the OU from SEPM add them again everything will fall in place


  • 8.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 11:24 AM
    I thought that was going to do it !!

    I didnt have any trouble following your instructions (good thing you included the "care should be taken" warning!!)....

    There were 6 entries for my workstation (the test client) -- I used the delete command which deleted 5 of them....but I still showed up in the default group.  I then deleted my workstation from the default group, ran the delete statement again which deleted my workstation from the db - so now my workstation wasnt in the db at all - I thought this was good, I told my client to update policy, and it showed up again in the default  group.

    Any further suggestions...it seems like we're close to a solution.

    thanks for your help!


  • 9.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 11:27 AM
    I guess I could do that as a last resort, but I would have to apply all my settings again to all OUs (unless there is a way to backup/restore them)...

    I have all my computers in various OUs under 1 main "computer" OU - I have to delete the 1 main OU (which would delete all the sub-OUs) as it wont let me delete the individual OUs


  • 10.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 12:31 PM
    Lets take this deleting process a step ahead... Since we will be doing a couple of DB manipulations, I'd suggest you to stop the SMC service on that test client...

    1.  SMC - stop

    2. DB manipulation again :

    This time, lets dig up for that client's entry in two more tables... SEM_COMPUTER and SEM_AGENT ..
    3. Delete the entries (if any) ... don't forget to delete from the SEM_CLIENT as well..

    4. After this, we just have to start the SMC service, but before we do so... Lets clear some cached information... Delete Sylink.Bak fro that client... and SylinkEx.bak(if present) ... and then SMC -start

    5. The client will now come up and look for SEPM... Lets see what happens...


    And oh, Once you delete the entries from the DB, just log off console and login back to check if you have that entry removed under your OU group... (apart from 'default view' ... )

    Am all ears now... :)



  • 11.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 02:24 PM
    I run into this with the AD sync feature.  Here's what works for me:
    1. Make sure your SEP sync is disabled for the time being.
    2. Move the problem workstation in AD to a group that is not sync'ing with SEP.
    3. Manually sync the SEP group where the workstation should belong.
    4. Run this command in your browser on the SEPM server: http://127.0.0.1:9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=CleanClients  This will automatically remove the duplicate clients.
    5. Move the problem workstation in AD back to the group where it should be.
    6. Re-enable sync'ing in the SEPM.
    This has worked for me every time.  HTH.


  • 12.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 02:31 PM
    Close - but not quite....I did delete my test workstation and it did disappear from SEP - after rebooting the client it showed up in the default group again..

    I went ahead and did as was suggested above - I deleted my OUs and re-added them - everything is syncing up fine now -- just a bit of work reapplying my settings everywhere...

    Thanks for your help!!


  • 13.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 02:33 PM
    Thanks Justin,

    I will definately try that if this happens again....I had already deleted my OU and re-added by the time I saw your suggestions...



  • 14.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 21, 2010 10:03 PM
    Well, after deleting the client from the database things would have gone straight if we had simply readded the OU .. We were just trying to avoid that task of adding it again and configuring the policies....Anyway,  good to know that things are in good shape now.. Hope SEP will continue to work fine.... or atleast till next new year.... :P ...


  • 15.  RE: Clients stuck or duplicated in Default Group

    Posted Jan 22, 2010 01:20 PM
    Are going to have to continue doing this again and again each time a computer is reimaged?


  • 16.  RE: Clients stuck or duplicated in Default Group

    Posted Feb 18, 2010 05:31 PM
    Thanks, Justin.  This worked perfectly.  I'd spent a bit of time on this issue, followed your instructions and the PCs were deleted from the non OU groups right away and after a few minutes they appeared in the right OU imported group!