Jump to content

What is correct way to delete duplicate endpoints?


rpnc
 Share

Recommended Posts

We use ESMC and EES for endpoints.

After reinstall endpoint (win7) OS in ESMC we have two accounts. Nothing special for ESET for some years...

2019-01-30_ESET_double_endpoints.thumb.png.252c509e2102f0f3abe3b53209db0ac5.png

Before ESMC in ERA there was option remove and it works, for ESMC there was three options.

2019-01-30_ESET_delete_options.png.1a2fd5401329d037057d89fc57ac999c.png

Q1: what option You suggest for delete old dublicate endpoint?

Q2: for ESET devs - is there any future vision about how to avoid duplicate endpoint registrations in ESMC?

 

Link to comment
Share on other sites

  • ESET Staff
4 hours ago, rpnc said:

We use ESMC and EES for endpoints.

After reinstall endpoint (win7) OS in ESMC we have two accounts. Nothing special for ESET for some years...

2019-01-30_ESET_double_endpoints.thumb.png.252c509e2102f0f3abe3b53209db0ac5.png

Before ESMC in ERA there was option remove and it works, for ESMC there was three options.

2019-01-30_ESET_delete_options.png.1a2fd5401329d037057d89fc57ac999c.png

Q1: what option You suggest for delete old dublicate endpoint?

Q2: for ESET devs - is there any future vision about how to avoid duplicate endpoint registrations in ESMC?

 

Option 3 will just remove entries from database and it is most suitable for removal of "dead" clone entries.

Regarding second option, duplicates in console are created when:

  1. Virtual machine with already installed ESET Management Agent is cloned. This should be targeted in ESMC 7.0 as part of VDI support, i.e. ESMC should be able to detect cloning of machines
  2. ESET Management Agent is reinstalled in client machine. This was not targeted, as it is not standard behavior and there should be no need to reinstall ESET Management Agent - could you specify why you actually did so?
Link to comment
Share on other sites

@MartinKabout duplicates. for us it's standard procedure:

- IT technician take a decision reinstall workstation/endpoint (many reasons);

- we use Windows Doployment Services;

- on fresh imagined endpoint, applying GPO and get ESET agent installed;

- device name after reinstall is the same because it based on asset number;

- and we have two identical endpoints in ESMC, one is outdated... for manual deletion

Is there any mechanism who can merge these both entries? because historical data about threat can help better understand what is really going on this endpoint in long term.

Link to comment
Share on other sites

  • 1 month later...

any update on how to handle this? we ended up reinstalling (not really a rare scenario in ANY environment) and getting duplicates.

since we name our devices as [prefix][serial number], we consistently use one hostname for the entirety of a machine life so having some way to dedup/over-write existing records would be perfect.

Edited by veehexx
Link to comment
Share on other sites

  • ESET Staff

For the future versions, we are planning to handle also "merge computer instance records", however it was not planned into the next version In general, what I would recommend is maybe to remove duplicates by "delete not connecting computers task", that you would set to a shorted number. It might delete also legitimate entries. But the agent is not considered as "duplicate" as it reports with a different UUID, as UUID is created upon first connection. But we are aware of this, and plan to handle it in the future. 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...