We've been replacing machines by removing them from the domain, deleting them out of AD, out of the SEC. We use the same names for the new systems i.e. old computer name = computer1 (after removal) new computer name = computer1. The AV pushes to the ma

Question

We've been replacing machines by removing them from the domain, deleting them out of AD, out of the SEC. We use the same names for the new systems i.e. old computer name = computer1 (after removal) new computer name = computer1. The AV pushes to the machine, but it never becomes "managed" it looks like it is still picking up remnants of the old account that was associated with the old computer. 
 How do remove and add systems (with the same name) appropriately?

VoicuChirtes · Answer

Hi Michael,

I am thinking you may have a communication issue here.

Can you confirm the Endpoint software is installed successfully on the newly deployed PC? I know you mentioned AV being pushed, so I am just double-checking: Is the AV a part of an image or installed after imaging on the endpoint?

Also, a few things to check could be: on the newly deployed computer, under Start->All programs->Sophos->Sophos Endpoint Security and Control->View Sophos Network Communications report. In there confirm the following:

All the states show "No problems detected."

Computer details shows:

Computer name: <correct computer name i.e computer1>

RMS router name: Router$<correct computer name i.e computer1>

Parent address: <some or all of the following: IP v6, v4, fqdn dns name and net bios name of the SEC server>

There is more possible troubleshooting to be done in order to confirm the communication, but the above should be a good start.

In regards to purging, if all communication is confirmed to be working fine, you can use the PurgeDB tool, see this KB for more info.

Let us know how this goes

Voicu.