ePO Agent 3.5 p5, Ghosting and ePO server 3.6 p2a

[FengTeo]

Hi All

I have a bit of a strange problem here. I suspect, but the end of this post, I'll be rambling a bit so I apologise in advance for

this.

We are running ePO 3.6 with patch 2a on a Windows 2000 SP4 server. It was originally upgraded from version 3.0.2a in a one step

process after first updating every agent in the business to 3.5.0.513. Everything seemed to be working fine until our latest Ghost

build.

The Ghost build is a Windows XP SP2 box, VSE8.0i patch 11a, and deployed WITH the epolicy agent preinstalled via deployment from the

ePO server. This is then syspreped and Ghosted.

All of this is running on an 2003 Active Directory network with various sites scattered around Australia (also with DCs in various

other states). The ePO server is housed at national office. There are approximately 320 users.

The problem we are experiencing is, any new machines that are added to the domain seem to randomly choose any machine container within

ePO and "take over" the other machine's node. It renames itself and changes all the details to match the new machine, and the old

machine is just deleted.

e.g.

SYDNEY-
- SYD001 (old machine)
- SYD002 (old machine)
- SYD003 (old machine)
- SYD004 (new machine, new image, updating and showing up fine)

I then add a Perth machine (for example) to the domain. Same image, same machine spec etc. I then go to ePO (after giving it time to

check in/update) and find it's taken over the SYD004 machine, after expecting it to appear in the Perth site container as follows.

SYDNEY
- SYD001 (old machine)
- SYD002 (old machine)
- SYD003 (old machine)
- PER010 (new machine, new image, taken over SYD004's node and updated all details (IP/userid etc) to it's own)

SYD004 is then no where to be found.

I then move the PER010 machine into the Perth container (where it should be).

If I then add SYD004 as a empty node into the Sydney site container, and perform an Agent Wakeup Call, it then takes over the Perth's

machine node.

Please note that this is completely random and can affect more than just a couple of machines. If i have a whole bunch of machines

freshly rolled out into a site, and I select them all and re roll out the agent to these machines, they all pick up fine.

In the past, we've had no issue creating images (2000 AND XP with VS 4.5.1SP1), and performing a sysprep WITH the epo client

installed. The new machines based on the previous image which were added to the network have always just shown up in the ePO lost and

found in the respective site (IP restricted). The old images were based on the old ePO client (forget which version) and still

perform fine when the new ePO agent is deployed to the machine again.

I've since tried a couple of things.

I backed up the database, and deleted every single node. Performed an Active Directy sync and pulled in all the machines. They

started picking themselve up fine. But, after an hour or so, certain machine began taking over machines on different sites.

All sites are restricted to IP range restrictions except the national office site. Problem machines tend to jump sites irrespective

of IP restrictions.

I haven't yet forwarded anything to McAfee. I know they'll say upgrade the ePO agent, but this doesn't not explain why I cannot Ghost

the existing one. I know that they'll work ok if I redeploy the agents again manually requesting that they reinstall the agent on the

client machine, but this is really a last resort.

Any help/past experiences would be greatly appreciated.

Regards
Feng Teo

 

[FengTeo]

OH... sorry for the messed up formatting. Copied it from a text document thinking it'd copy over the word wrapping (which it in fact has done. If I could edit it, I would.

Regards
Feng

 

[FengTeo]

While I was messing around on another forum, I discovered this.

I suspect this is the issue we're having.

There is a unique agent registry ID for each computer and if you are using imaging software such as Ghost, this can screw things up. When you make your host images, your very last step needs to be to stop the framework service and then you need to remove HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\AgentGUID

Hope this helps anyone else there.

 

[FengTeo]

And yet another note for those who may have this issue... if you've got it set up on machine, I wrote a batch file to delete them via cmd prompt (we don't have SMS or other such utils).

netsvc mcafeeframework \\machinename /stop
reg delete "\\machinename\HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent" /v AgentGUID /f
netsvc mcafeeframework \\machinename /start

This will stop the framework service, and delete the key, and restart it (tested and yes, regenerates the AgentGUID key).