Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 3 subscribers
  • Views 2996 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Non-existent PC reappearing in SEC

carina

I have a new computer which has the same name as a very old computer that has not existed for many years.

I am trying to install Sophos via the Enterprise console but cannot as despite deleting the original computer, when I re-discover computers it somehow picks up the old one, not the new one.

I can tell it is the old one as it is greyed out and the details say it is Windows Vista (the new on is Windows 10).  This old one hasn't existed on AD for at least 10 years.

When we change computers we have regularly re-used names without a problem so I don't know why this one should be different.

I have read some stuff about the SEC keeping hold of info in the database even when computers are deleted and some people said there is a workaround to delete them completely but it was a thread from about 10 years ago and I didn't know if it was still relevant and it wasn't clear what to do.

I know an easy solution would be to give the computer a different name, but would prefer the current name if possible, and would like to understand why SEC does not delete computers when they are no longer in AD, and if there is a way to delete them that could be explained in fairly simple terms. 

 



This thread was automatically locked due to age.
  • 0

    Hello carina,

    trying to install Sophos using Protect computers? but cannot because it won't protect Vista? With what method do you re-discover?

    Christian

  • 0 in reply to QC

    I'm not trying to protect a Vista computer.  The Vista computer was scrapped 10 years ago but still seems to be in the SEC database.

    I'm trying to protect a new Windows 10 computer which has the same computer name.

    The method to re-discover is to click the 'Discover Computers' button in the top left-hand corner of the SEC window.

  • 0 in reply to carina

    Hello carina,

    [:)] the 'Discover Computers' button offers several methods, one is a plain Import. I know you are not trying to protect a Vista computer, but you say you cannot - so, why, what happens? Nothing happens? Or you get an error (which one)? I understand that the old one somehow gets in the way.

    Christian

  • 0 in reply to QC

    I am using 'Discover on the network'.

    When applying it says 'The applied software subscription does not contain software this computer can use.', because it thinks the computer is Windows Vista not Windows 10

    The only information given in the SEC widow is the Operating System.

  • 0 in reply to carina

    Hi  

    You can give it a try to use purgeDB which will delete the entry from the database if any. Please check this article for more information. Have you tried installing manually (from \\server\SophosUpdate\CIDs\S000\SAVSCFXP\)? 

    Shweta

    Community Support Engineer | Sophos Technical Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
    The New Home of Sophos Support Videos! - Visit Sophos Techvids
  • 0

    Hello carina,

    thanks for the information. Time to go into details.
    Indeed when you delete a computer from the console its data is kept. A long time ago there was an incarnation of the console that exposed this functionality with hide/unhide. Now there's only the delete which is admittedly misleading. The main reason to just hide the compute from view (and reports) is to prevent accidental data loss. Please note that there's a tool (PurgeDB.exe) to deliberately delete computers and their associated data from the database based on certain criteria.
    when they are no longer in AD
    SEC doesn't assimilate into AD. From SEC's POV AD is just a source of information, namely structures of containers and contained computer objects with some of their attributes. Unless you use Active Directory sync SEC doesn't consider AD. Completely deleting computer objects when they "disappear" from AD is perhaps not ideal -  not all sites use AD in the same manner

    It looks like Discover can't retrieve the operating system version from the computer. It finds a known name and revives (undeletes, unhides) the old entry. As its OS is no longer supported you can't use Protect.

    Although unsupported, the DELETE FROM mentioned in various other threads can still be used to remove specific computers from the database but PurgeDB is the recommended tool.

    Christian

  • 0 in reply to QC

    I have run the purgedb command as suggested by Christian and it said a number of rows were affected.

    I have now re-added the PC to the Sophos console, this time by IP address so I would be sure of getting the right PC.

    Sophos is still not installing.

    When I open up the details in the Enterprise Console window it now has the correct information for Computer description and Operating System, so it has obviously picked up the new PC, however it has the wrong IP address; it has the ancient IP address of the original computer, so it seems as if purgedb command has purged some information but not the IP address.

  • 0 in reply to carina

    Hi  

    Is it showing the same error? While using 'Find by IP range' to search for new computers, a Windows username and password are used for the Windows network search. Kindly take a look at this article for more information. 

    Shweta

    Community Support Engineer | Sophos Technical Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
    The New Home of Sophos Support Videos! - Visit Sophos Techvids
  • 0 in reply to Shweta

    I have had to resort to renaming the PC to a new name as I could not get Sophos to 'let go' of the old IP address, and can't carry on using my PC any longer without Sophos installed.

    I deleted the PC from Sophos, double-checked it was deleted from AD, was not showing up in the network.

    Tried all means of 'Discover Computers' and each time it brought back the old one.

    I can only conclude that there is still some info left behind in the database that the purgedb did not eliminate.

  • 0 in reply to carina

    Hello carina,

    I'd suggest that you check what's actually in the database (use the appropriate instance and database name):

    sqlcmd -E -S .\SOPHOS -d SOPHOS551 -Q "SELECT [ID],[Name],[DomainName],[OperatingSystem],[Managed],[IPAddressText],[Deleted],[InsertedAt]
      FROM [dbo].[ComputersAndDeletedComputers] Where Name = 'PROBLEMPC'

    This will show whether you have still a computer with this name in the database.

    Christian

Unfiltered HTML