Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

Reason for clients switching to usermode automatically

  • 1.  Reason for clients switching to usermode automatically

    Posted Jan 26, 2011 01:48 AM

     

    Can any one help me to sort out the reason why the cleints switch automatically to usermode 

    I am using the lastest version Ru6 Mp2

    Thanks

    Gerald



  • 2.  RE: Reason for clients switching to usermode automatically

    Posted Jan 26, 2011 01:54 AM

    Strange that you are facing the  issue with ru6 mp2. This was supposed to be resolved  in MR4.

    Some Symantec Endpoint Protection (SEP) clients switch automatically from "Computer mode" to "User mode 

    http://clientui-kb.symantec.com/kb/index?page=content&id=TECH97888&actp=search&viewlocale=en_US&searchid=1296024686982

    I think, you must call support, and open a case.



  • 3.  RE: Reason for clients switching to usermode automatically

    Posted Jan 26, 2011 01:55 AM

    Before that, though, just have a look at this:

    http://clientui-kb.symantec.com/kb/index?page=content&id=TECH131749&actp=search&viewlocale=en_US&searchid=1296024686982



  • 4.  RE: Reason for clients switching to usermode automatically
    Best Answer

    Posted Jan 26, 2011 02:38 AM

    There might be a situation whereby there are doubling records in SEPM database. Could you please indicate if you have been migrating recently or did you install a new version from scratch?



  • 5.  RE: Reason for clients switching to usermode automatically

    Posted Jan 26, 2011 03:49 AM

    Thanks people will check with the customer and update



  • 6.  RE: Reason for clients switching to usermode automatically

    Posted Jan 26, 2011 10:05 PM

    I checked there is No Active directory OU setup but there is replication setup]

    Hence Is there any thing else which could help be to sort the Issue

    Thanks



  • 7.  RE: Reason for clients switching to usermode automatically

    Posted Jan 27, 2011 02:55 PM

    Hi.

    I have the same problem & also have no AD integration.

    You might want to look at this discussion: https://www-secure.symantec.com/connect/forums/sep-clients-change-computer-mode-user-mode-also-appears-different-sepm-folder and specifically my comments from 21st Jan 2011.

    Haven't had any user mode objects appear since then. I thought it might be related to https://www-secure.symantec.com/connect/idea/case-413-575-383-duplicate-computer-objects-after-re-imaging-pc-sephwidxml-issue, but we've re-imaged a lot of PC's since then in exactly the same manner as before & still no user mode objects.



  • 8.  RE: Reason for clients switching to usermode automatically

    Posted Jan 28, 2011 01:44 AM

    Thanks for the Link will check-out after the week-end  and let know the update

     

    Great Week-end to all My friends and Form User



  • 9.  RE: Reason for clients switching to usermode automatically

    Posted Jan 28, 2011 10:58 AM

    Three main reasons to run into a unexpected User Mode entries in the SEPM:

    AD import of user objects. If a computer does not match an imported computer object (computer name/computer domain) and matches an imported user object (user name/user domain), the computer will be in user mode.

    A “new” computer checks in to the SEPM and does not match any existing SEPM entries. Its preferred mode is 0 (user mode). As other “new” computers check in, they may have the same user name/user domain as one of the user entries created by this first computer. Keep in mind, this will only happen to computers that act like new entries in the SEPM (purged due to client timeout, deleted by administrator, OS uninstall/reinstall causing new hardwareID to be generated).

    A SEPM administrator switches one of the computer entries to user mode. “new” computers that have one of the user name/domain combinations that match will be added as user mode. Once again, this only affects computers that appear as new to the SEPM (don’t line up with existing entries due to purge by client timeout, administrator deletion, new HWID, etc).

    Are you importing AD user objects?

    Can  you avoid importing these objects if you do not intend to use them?

    Were any clients installed in User Mode?

    Check  the ersecreg.log and ersecreg-1.log for any computer that is sending:

    Preferredmode=”0”

    What is the client timeout configuration?

    You may need to increase this value to more appropriately match the environment in order to prevent clients from purging too early.

    Did youconverted any computer objects to user objects?



  • 10.  RE: Reason for clients switching to usermode automatically

    Posted Jan 31, 2011 02:13 AM

    Thanks  will check the following and update according



  • 11.  RE: Reason for clients switching to usermode automatically

    Posted Feb 11, 2011 09:07 AM

    Hi

    Sorry for the late reply MAC it was double entre problem

    Thanks



  • 12.  RE: Reason for clients switching to usermode automatically

    Posted Feb 11, 2011 10:38 AM

    Followers of this thread may wish to vote in support of these "Ideas" (enhancement requests)

    "Restrict the ability to enable User mode" https://www-secure.symantec.com/connect/idea/restrict-ability-enable-user-mode

    "Remove the mechanism that turns clients from computer mode to user mode" https://www-secure.symantec.com/connect/idea/remove-mechanism-turns-clients-computer-mode-user-mode

    "Ability to switch large numbers of SEP Clients from User Mode to Computer Mode en masse from within the SEPM Console" https://www-secure.symantec.com/connect/idea/ability-switch-large-numbers-sep-clients-user-mode-computer-mode-en-masse-within-sepm-console

    Thanks and best regards,

    Mick