When I came back from the weekend there was an issue with one of our staffs computers. I recently pushed out a fixlet to remove Microsoft Office from the majority of our endpoints with the exception of some. One of those exceptions had it removed when it shouldn’t have. Their computer had two entries in Bigfix (one greyed out; last checkin date was 8/30/17 and the other being a new entry and was showing active). The only difference was a new IP address, which I wouldn’t think would be the reason her computer had a new creation of itself. The real issue here is that I had added their computer to a group which would keep the fixlet from removing MS Office on their computer and this new entry of their computer wasn’t in that group which made her lose MS Office.
I was just curious if anyone else has seen this issue and why this happened.
You can also verify the Bigfix client installation date. If the installation date is very recent then this can be one of the reason for the issue you are facing.
This staff member has had Bigfix installed for a little over a year. They haven’t ever had this happen before, and I haven’t seen any other users with duplicate computer entries. I’m hoping that this isn’t going to be a recurring issue, because this can cause a vast amount of stress for our faculty.
I cannot see how this would happen given the scenario you provided.
One thing I have seen happen is uninstall packages that were created using some type of snapshot technology. The snapshot included a bunch of “stuff” that should not have been in there and was not related to the product being uninstalled. Is it possible that the package might have removed some bigfix registry keys or file system objects?
I didn’t do any sort of snapshot uninstall. I used the Microsoft Office registry setup.exe to uninstall silently. I’m positive that no bigfix refistry keys were removed.
Yeah I can vouch for WretchedKat here. We deploy during initial device setup so it is not a new install. And we typically only do clean silent installs / uninstalls including this situation. We haven’t really seen this greyed out duplicate computer situation even after OS reinstalls. BF can normally tell that it’s the same PC even with a new client OS and even BF client version. Maybe this is a rare situation we won’t see much of again. Here’s hoping!
I get new instances/duplicates of computer accounts from BigFix fairly frequently, but I’m using VM Snapshots/Rollbacks, dual-boot systems, and some other custom things that can cause a client reset.
Changing the IP address alone should not cause that. You might check that the actual machine was not replaced, if you can compare MAC address or serial numbers between the two computer instances.
Otherwise, if something cleared or corrupted the __BESData folder, that could cause a client reset.
Yeah I checked the MAC address when I first saw the duplicate and it was the same MAC address. Wasn’t sure why it suddenly created a new instance of itself. It hasn’t done it again, and this was the only instance of this that I’ve seen so far.
The client logs will indicate why the endpoint changed its computerid. Usually it is on the request of the server, however learning this after this length of time is probably not possible as that log would have been deleted.
There are some sequences in the registry which might have been rolled back by some uninstall method which could have caused this if some system snapshot was taken.
It’s a little late to help you with this incidence, but I’m guessing you used a Manual Group.
Next time, don’t.
Use an Automatic Group and add a rule to add computers based on something like Computer Name. This way, if the client does reset, the computer should still have the same Computer Name and should rejoin the group.
Yeah, I used a manual group to exclude certain computers from the automatic group that was used to target computers with Microsoft Office to remove it. The manual group contains all computers we want to keep MS Office on, while the automatic group will exclude all computers within said manual group. So far we’ve only had one end client do this reset, so I’m not too worried, was just curious about this reset and what caused it. I appreciate everyone’s help, this is a great forum community!
Just a heads up, it’s been my experience that IBM doesn’t recommend using Manual Groups.
They can’t be shared between Console Operators (they seem to live you your Operator site) so if you have multiple Console Operators supporting systems, they might have trouble managing them.
The only exception to people not being able to see the Manual Groups is when the Manual Group is created by a Master Operator and it goes into the Master Action site, but you really want to keep that site as clean as possible.
What is the treatment in a cloned copy of a server (VM) which was only used for troubleshooting purposes? Used as a backup only and was deleted when troubleshooting is done. Is the cloned copy included in calculation or it is exempted? Thank you.
Included in sub capacity license calculation. For example the cloned server has DB2 software (subcapacity licensing) installed, then the inactive entry is deleted in bigfix console as well as its metric utilization report in ILMT metric report.
Hi. Thanks for the opinion. Yes thats what i did. Since theres already 2 same entries (same computer name but different computer ID) in bigfix console, I deleted the first/old entry in bigfix console since its inactive already (doesnt report to bf server, cannot be scanned too). I also deleted the software scan results in the ILMT report but its software scan results still reflects in audit report (1 year period) though its indicated in audit report that the computer is already deleted.
Then the 2nd entry exists as if its a new entry which means it has yet to be scanned (SW and capacity scan) and upload the results in ILMTserver.
I already scanned and upload its results to ilmt server.
My concern is will the ibm still include the software scan result of the old entry in license calculation? Coz if they will the metric utilization for the server will appear to be 2 times, which is i believe inaccurate
It’s my understanding that licensing only applies to computers that have reported to the Server in the last 24 hours. You can verify this by looking at the “Deployment Information” section under the BigFix Management Domain under the Deployment Overview. You should see two different computer counts. One for “Agents Deployed:” and another for “Agents Reported in the Last Day:”.