Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 11742 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clients unexpectedly show up in "Unassigned" group after being Protected.

Lestat

I found what I consider a bug in the Enterprise Console when "Protecting" computers.  I am running Enterprise Console 4.0.0.2362.

Steps to reproduce the problem:

Create a new Windows machine TEST and join it to your Domain.

In the Sophos Enterprise Console, use the "Find new computers" button to locate the TEST machine.  TEST shows up in UNASSIGNED group.

Delete TEST from the Unassigned group (because you realized that you want to utilize the "Synchronize with Active Directory" feature instead.)

Synchronize with Active Directory -- TEST shows up under the proper Group (for example, DESKTOPS) as a greyed out name (because SophosAV is not installed).

Right-click on TEST and select "Protect Computers" option.


Expected Behavior:


After SophosAV installation, TEST should remain in the DESKTOPS Group.

Observed Behavior:


After SophosAV installation, TEST shows up in the UNASSIGNED Group until the next time an AD Synchronization is performed.  

Depending on the interval between Synchronizations, TEST may not have the correct Policies applied for some time.

Notes

Where this bites me is that I used the Find New Computers wizard against my entire Domain when I first installed my Enterprise Console, and then I deleted all computers from the Unassigned Group.  Now I am ready to start pushing out Sophos and found out that newly installed computers will not start to use my defined policies until after an AD sync.  I am currently syncing every 60 minutes.

I guess I can bump my AD Sync interval way down (5 minutes?), but this was unexpected behavior to me.

:2824


This thread was automatically locked due to age.
  • 0

    Opened Support Ticket # 2316121 for this.

    :2825
  • 0

    Guess it's the logic introduced in SEC4 for recognizing and undeleting "previously seen and deleted" computers. 

    Don't know what support will suggest. I would "really delete" the found and deleted computers which have been in the Unassigned group with:

    sqlcmd -E -S . -d SOPHOS4 -Q "DELETE from ComputersAndDeletedComputers Where NAME='TEST' AND Deleted=1 AND ID IN (SELECT ComputerID FROM ComputerGroupMapping Where GroupID=1)"

     Omit NAME='TEST' AND to remove all computers after you've confirmed with 'TEST' that it works.

    Christian

    :2834
  • 0
    Lestat wrote:

    Opened Support Ticket # 2316121 for this.

    Heard back from support:

    "This is a known defect that has to do with DNS name recognition, our messaging system and the different database tables that deal with computer names (and whether or not they've been deleted).  There is no ETA on a fix, at the moment."

    So I guess that the best workaround is to set the AD Synchronization interval to a very small number.

    :3051
Unfiltered HTML