What is correct way to delete duplicate endpoints?

[rpnc 2]

We use ESMC and EES for endpoints.

After reinstall endpoint (win7) OS in ESMC we have two accounts. Nothing special for ESET for some years...

Before ESMC in ERA there was option remove and it works, for ESMC there was three options.

Q1: what option You suggest for delete old dublicate endpoint?

Q2: for ESET devs - is there any future vision about how to avoid duplicate endpoint registrations in ESMC?

 

[MartinK 378]

4 hours ago, rpnc said:

We use ESMC and EES for endpoints.

After reinstall endpoint (win7) OS in ESMC we have two accounts. Nothing special for ESET for some years...

Before ESMC in ERA there was option remove and it works, for ESMC there was three options.

Q1: what option You suggest for delete old dublicate endpoint?

Q2: for ESET devs - is there any future vision about how to avoid duplicate endpoint registrations in ESMC?

 

Option 3 will just remove entries from database and it is most suitable for removal of "dead" clone entries.

Regarding second option, duplicates in console are created when:

1. Virtual machine with already installed ESET Management Agent is cloned. This should be targeted in ESMC 7.0 as part of VDI support, i.e. ESMC should be able to detect cloning of machines
2. ESET Management Agent is reinstalled in client machine. This was not targeted, as it is not standard behavior and there should be no need to reinstall ESET Management Agent - could you specify why you actually did so?

[rpnc 2]

@MartinKabout duplicates. for us it's standard procedure:

- IT technician take a decision reinstall workstation/endpoint (many reasons);

- we use Windows Doployment Services;

- on fresh imagined endpoint, applying GPO and get ESET agent installed;

- device name after reinstall is the same because it based on asset number;

- and we have two identical endpoints in ESMC, one is outdated... for manual deletion

Is there any mechanism who can merge these both entries? because historical data about threat can help better understand what is really going on this endpoint in long term.

[veehexx 1]

any update on how to handle this? we ended up reinstalling (not really a rare scenario in ANY environment) and getting duplicates.

since we name our devices as [prefix][serial number], we consistently use one hostname for the entirety of a machine life so having some way to dedup/over-write existing records would be perfect.

Edited March 6, 2019 by veehexx

[MichalJ 434]

For the future versions, we are planning to handle also "merge computer instance records", however it was not planned into the next version In general, what I would recommend is maybe to remove duplicates by "delete not connecting computers task", that you would set to a shorted number. It might delete also legitimate entries. But the agent is not considered as "duplicate" as it reports with a different UUID, as UUID is created upon first connection. But we are aware of this, and plan to handle it in the future.