Not all systems appear in the console as managed

Question

Hi, 
 I am having a problem where not all systems appear in the dashboard. I am stuck at 45 managed systems although there are 54 systems with the software installed and the correct information in "%ProgramData%\Sophos\Remote Management System\3\Router\NetworkReport\ReportData.xml". 
 If I restart the agent on one of the servers that does not appear in the dashboard it will appear, but another system will drop from the dashboard. So although there are 45 managed systems, they change. 
 I have checked the "C:\ProgramData\Sophos\AutoUpdate\data\machine_ID.txt" on all systems to verify there are no duplicate machine IDs. 
 Does anyone have any ideas on what I could look at next? 
 Thank you

QC · Accepted Answer

Hello provisional Identity , 
 it looks like some machines are clones, please follow the steps in the appear to update the same record article. It does no harm and should eventually "untangle" the endpoints. 
 Christian

jak · Answer

The AutoUpdate machine ID is based on a hash of the set of MAC addresses on the computer. So I guess if you have multiple NICs and you disable one, it will be different, then as you add it back it will then be the same.

QC · Answer

Hello provisional Identity , 
 SEC, the management, aims to identify "the same" endpoint in various scenarios: 
 
 the endpoint is renamed 
 SAV is reinstalled 
 the endpoint is reimaged keeping its name 
 the hardware is changed 
 the hardware is replaced 
 
 The algorithm has been developed and refined over time but it has (still) its shortcomings. It's all but impossible though to get rid of all of them. Won't give all the finicky details here. 
 show systems with different Machine IDs and the same PKC When RMS doesn't find a certificate upon starting it requests one for the subject Router$ computername : number (AFAIK number is a more or less random value) - this is the MessageSystemAddress attribute of the endpoint in the database. If two computers with a different name have the same certificate this suggests they have been "derived" from the same image (on which RMS was already initialized). From SEC's POV they appear as the same computer that has been renamed (that this computer changes its name frequently makes no difference - Macs "could do it all the time"). a way for the endpoint to realize its PKC already exists The endpoint has (and can have) no idea that someone else uses the same certificate. It requested and obtained a certificate in the past and it's not even aware of other endpoints. Why should it say: Hey, this is my unique certificate, is it really still unique? 
 Mind you, if SAV - as recommended - is only installed on a machine that has obtained its "final identity" these things don't happen. Furthermore, once the machines have been "untangled" they don't fall back to using the same identity. 
 Christian