Symantec computer search returns non-existent host names

Hello,

Thank you for posting here.

According to your description, I understand that:

You have a concern about the reason why the software returns the old host
name.

If I have misunderstood the problem, please don't hesitate to let me know.

Suggestions:
================
For the exact method how Symantec Endpoint Protection search computers in
the domain, I think that Symantec is best resource. I suggest that you
contact the support engineer of Symantec at the same time so that this
problem can be resolved efficiently.

Although I have not used Symantec Endpoint Protection search function
before, I'd like to share some experience. Hope that it can be of
assistance. Based on my experience, to get the lust of all computers in the
domain, software usually query the Active Directory for all computer
accounts in the domain. By default, the old computer account is set to be
disabled when the computer renames. Those disabled computer accounts may be
queried by the software and be recognized as the valid computers. You may
try to search the Active Directory for disabled computer accounts.

For your reference, you can use the VBS script to search computer accounts
in the domain.

Active Directory > Searching Active Directory> Computers
http://www.microsoft.com/technet/scriptcenter/scripts/default.mspx?mfr=true


Hope it helps.



Best regards,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Fri, 17 Oct 2008 08:56:51 +0100, Joe wrote:

>Ray Greene wrote:
>> I'm setting up Symantec Endpoint Protection on our SBS 2003 domain.
>> It has a feature where it will search for computers on the network and
>> determine which ones have Symantec installed.
>>
>> The problem is that it will often return an old host name that was
>> once associated with a particular IP address but no longer exists. It
>> will even do this if it searches by the current host name rather than
>> the IP address.
>>
>> I assumed that it was finding old host names in DNS, so I went through
>> and deleted all of the old records but it's still happening.
>>
>> I've asked on the Symantec forums but no one there seems to know
>> what's happening.
>>
>> Can anyone suggest where it might be finding these old names?
>>
>How about DHCP? Are there perhaps expired leases from the last time
>these hosts ran, which have not actually been removed? The server may be
>waiting for these hosts to come online again to give them back their
>last recorded addresses, and not issuing those addresses in new leases
>until it runs out of never-used ones.

That's a good suggestion, but all of our PCs have fixed IP addresses.
We do have DHCP for guest machines but none of the host names in
question ever used DHCP.

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Fri, 17 Oct 2008 09:50:50 GMT, v-mileli.RemoveThis@online.microsoft.com (Miles
Li [MSFT]) wrote:

>Hello,
>
>Thank you for posting here.
>
>According to your description, I understand that:
>
>You have a concern about the reason why the software returns the old host
>name.
>
>If I have misunderstood the problem, please don't hesitate to let me know.
>
>Suggestions:
>================
>For the exact method how Symantec Endpoint Protection search computers in
>the domain, I think that Symantec is best resource. I suggest that you
>contact the support engineer of Symantec at the same time so that this
>problem can be resolved efficiently.
>
>Although I have not used Symantec Endpoint Protection search function
>before, I'd like to share some experience. Hope that it can be of
>assistance. Based on my experience, to get the lust of all computers in the
>domain, software usually query the Active Directory for all computer
>accounts in the domain. By default, the old computer account is set to be
>disabled when the computer renames. Those disabled computer accounts may be
>queried by the software and be recognized as the valid computers. You may
>try to search the Active Directory for disabled computer accounts.
>
>For your reference, you can use the VBS script to search computer accounts
>in the domain.
>
>Active Directory > Searching Active Directory> Computers
>http://www.microsoft.com/technet/scriptcenter/scripts/default.mspx?mfr=true
>
>
>Hope it helps.

Thanks for the link Miles. There are some good scripts there!
I tried the one you suggested and it found the same non-existent PCs
that Symantec found.

Is it just getting this information from the domain controller, or is
it querying all the PCs in the domain?

Some of the other PCs may still have cached records of the mystery
machines but I can't find any trace of them on the domain controller.
I cleared out all the old records of them from DNS and deleted all the
old accounts.

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Mon, 20 Oct 2008 16:47:58 +1300, Ray Greene wrote:

>On Fri, 17 Oct 2008 09:50:50 GMT, v-mileli.TakeThisOut@online.microsoft.com (Miles
>Li [MSFT]) wrote:
>
>>Hello,
>>
>>Thank you for posting here.
>>
>>According to your description, I understand that:
>>
>>You have a concern about the reason why the software returns the old host
>>name.
>>
>>If I have misunderstood the problem, please don't hesitate to let me know.
>>
>>Suggestions:
>>================
>>For the exact method how Symantec Endpoint Protection search computers in
>>the domain, I think that Symantec is best resource. I suggest that you
>>contact the support engineer of Symantec at the same time so that this
>>problem can be resolved efficiently.
>>
>>Although I have not used Symantec Endpoint Protection search function
>>before, I'd like to share some experience. Hope that it can be of
>>assistance. Based on my experience, to get the lust of all computers in the
>>domain, software usually query the Active Directory for all computer
>>accounts in the domain. By default, the old computer account is set to be
>>disabled when the computer renames. Those disabled computer accounts may be
>>queried by the software and be recognized as the valid computers. You may
>>try to search the Active Directory for disabled computer accounts.
>>
>>For your reference, you can use the VBS script to search computer accounts
>>in the domain.
>>
>>Active Directory > Searching Active Directory> Computers
>>http://www.microsoft.com/technet/scriptcenter/scripts/default.mspx?mfr=true
>>
>>
>>Hope it helps.
>
>Thanks for the link Miles. There are some good scripts there!
>I tried the one you suggested and it found the same non-existent PCs
>that Symantec found.
>
>Is it just getting this information from the domain controller, or is
>it querying all the PCs in the domain?
>
>Some of the other PCs may still have cached records of the mystery
>machines but I can't find any trace of them on the domain controller.
>I cleared out all the old records of them from DNS and deleted all the
>old accounts.

Just had a closer look and I see that Symantec has found one PC which
the search script missed. I'm puzzled...

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

Hello Ray,


The computer accounts listed by the script retrieve from Active Directory
on the domain controller. It doesn't contact the computer one by one in the
domain.

According to the symptom, I guess that the Symantec Endpoint Protection has
some kind of cache locally. You may get more information from Symantec
support to know whether there is cache; and if so, how could you clear it.

By the way, if you delete the accounts of the non-existent PCs in the
Active Directory Users and Computers can you still see it in the Symantec
Endpoint Protection?

Hope it helps.


Best regards,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Mon, 20 Oct 2008 10:26:23 GMT, v-mileli.RemoveThis@online.microsoft.com (Miles
Li [MSFT]) wrote:

>Hello Ray,
>
>
>The computer accounts listed by the script retrieve from Active Directory
>on the domain controller. It doesn't contact the computer one by one in the
>domain.
>
>According to the symptom, I guess that the Symantec Endpoint Protection has
>some kind of cache locally. You may get more information from Symantec
>support to know whether there is cache; and if so, how could you clear it.
>
>By the way, if you delete the accounts of the non-existent PCs in the
>Active Directory Users and Computers can you still see it in the Symantec
>Endpoint Protection?

Yes, they still show up there.

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

Hello Ray,

As we have found, the Symantec Endpoint Protection gets the computer list
from the Active Directory and has its own detection logic and cache
function.

However, please understand that I don't mean to bounce you between support
professionals as I am fully aware how time consuming this can be. However,
Symantec support really is in a better position to be able to assist you
with this issue as they may have experienced similar issues.

Thanks for your understanding.

Best regards,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Tue, 21 Oct 2008 10:06:53 GMT, v-mileli.DeleteThis@online.microsoft.com (Miles
Li [MSFT]) wrote:

>Hello Ray,
>
>As we have found, the Symantec Endpoint Protection gets the computer list
>from the Active Directory and has its own detection logic and cache
>function.
>
>However, please understand that I don't mean to bounce you between support
>professionals as I am fully aware how time consuming this can be. However,
>Symantec support really is in a better position to be able to assist you
>with this issue as they may have experienced similar issues.
>
>Thanks for your understanding.
>
>Best regards,
>Miles Li

No problem Miles, thanks for the help.

It's not a big problem, I was mostly curious as to what was happening.
Symantec know about it but don't seem to be in a hurry to provide an
explanation or to fix it.

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

I have 0 experience of SEP but maybe it's also doing a WINS search? If so
just delete all records from WINS, the PCs will reregister.

"Ray Greene" wrote in message

> On Tue, 21 Oct 2008 10:06:53 GMT, v-mileli.RemoveThis@online.microsoft.com (Miles
> Li [MSFT]) wrote:
>
>>Hello Ray,
>>
>>As we have found, the Symantec Endpoint Protection gets the computer list
>>from the Active Directory and has its own detection logic and cache
>>function.
>>
>>However, please understand that I don't mean to bounce you between support
>>professionals as I am fully aware how time consuming this can be. However,
>>Symantec support really is in a better position to be able to assist you
>>with this issue as they may have experienced similar issues.
>>
>>Thanks for your understanding.
>>
>>Best regards,
>>Miles Li
>
> No problem Miles, thanks for the help.
>
> It's not a big problem, I was mostly curious as to what was happening.
> Symantec know about it but don't seem to be in a hurry to provide an
> explanation or to fix it.
>
> --
> Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names 

On Wed, 22 Oct 2008 08:05:08 +1100, "SuperGumby [SBS MVP]"
wrote:

>I have 0 experience of SEP but maybe it's also doing a WINS search? If so
>just delete all records from WINS, the PCs will reregister.

I had a look but none of the old host names in question are in WINS
either.

--
Ray Greene
 >> Stay informed about: Symantec computer search returns non-existent host names