PCs are showing as unmanaged on SEC

Hello Tharaka,

integrated with the active directory
you mean you are using AD synchronization? Please use the same terms as SEC - this helps to avoid misunderstandings.

categorized under unmanaged section
you are talking about the Unmanaged view (either selected with the View: drop-down or by clicking the link in Dashboard's Computers pane)? And the computers are in the correct groups mirrored from the AD OUs?
Please check the Network Communications Report on one of these endpoints. If it shows the correct Current parent address the endpoint should be in the console as managed - it should be in the Unassigned (or even some other) group if the corresponding computer from AD is in the correct group but unmanaged. In other words - you should see these computers twice.

Christian

Hello Christian,

integrated with the active directory
you mean you are using AD synchronization? Please use the same terms as SEC - this helps to avoid misunderstandings.

Yes, I am using AD synchronization to import the PC list. I am not using the discover computer option of the SEC to detect end PCs.

categorized under unmanaged section
you are talking about the Unmanagedview (either selected with the View: drop-down or by clicking the link in Dashboard's Computers pane)? And the computers are in the correct groups mirrored from the AD OUs?
Please check the Network Communications Report on one of these endpoints. If it shows the correct Current parent address the endpoint should be in the console as managed - it should be in the Unassigned (or even some other) group if the corresponding computer from AD is in the correct group but unmanaged. In other words - you should see these computers twice.

I am talking about the unmanaged section appears by clicking the link in the dashboard. and i cannot understand what you meant from " 
If it shows the correct Current parent address the endpoint should be in the console as managed - it should be in the Unassigned (or even some other) group if the corresponding computer from AD is in the correct group but unmanaged. ". I will look at the Network Communication Report for the further details. As I said before ParentRouterAddress" and "MRParentAddress" are correct. That is why I am confused about this scenario.

Thanks.

Tharaka.

Hello Tharaka,

thanks for the clarification.
As for mrinit.conf: It is stored in the CID and unless have modified it at some point or have message relays (and therefore several CIDs and mrinit.conf) the one on the endpoint is the same as in the CID. But even if it is correct and successfully applied by RMS communication can fail. A simple example is an off-network endpoint which won't be able to connect to a management server which has no public IP (directly or port-forwarded). Thus only the Network Communications Report is significant for determining the actual communication status.

Trying to rephrase what's not clear to you:
A common error scenario is that for whatever reason an endpoint (say OU1-PC001) which contacts the management server is not recognized as the computer synched with AD. Then you'll see an unmanaged OU1-PC001 in group \OU1 and another OU1-PC001 as managed and up-to-date in (usually) the Unassigned group. Thus you should check if there are (many) duplicates in the All computers view. This should also be obvious from the total number of computers of course.
It's possible that (again for whatever reason) some endpoints can't successfully register with the management server. The synched computers will simply show as unmanaged, the total number will be more or less correct.
Yet another option is that some computers have been cloned incorrectly (i.e. after Sophos has been fully installed and the required steps omitted). You'd likely have noticed though as in this case some of the managed computers would continuously change their name and unmanaged ones "move" from their AD group to Unassigned and back.

Christian 

Hi Christian,

yes you were correct, there are about 24 computers which are in both unassigned group as well as AD OU. is there a particular reason for this behavior? 

Hello Tharaka,

24 is only a small fraction so with the majority it must be a different issue.
Anyway, AFAIK, there are two main scenarios where this could happen: 1) The computer is renamed when it's already joined to the domain  and 2) Sophos is installed before the computer is joined to the domain (but in both cases it depends on the sequence of events - the endpoint informing SEC of the name/domain change and SEC "seeing" the new name in AD).

Christian 

Hi Christian,

What can we do to correct this behavior, I deleted both endpoints from SEC and waited till synchronization happen again. but still some computers are going to unassigned group.

Thanks,

Tharaka

Hi Christian,

What can we do to correct this behavior, I deleted both endpoints from SEC and waited till synchronization happen again. but still some computers are going to unassigned group.

Thanks,

Tharaka

Hello Tharaka,

depending on the attributes stored with the computers delete from the console might or might not help to correct this problem. Please note that delete just flags the computer object (thus both entries remain in the database but are not visible) and there are, as said, two data sources - the messages from the endpoint and the sync from AD.

While unsupported it'd perhaps be necessary to delete the duplicates from the database - use at your own risk, backup the database first (though I've never had any problems with this command, just make sure you don't hit the wrong ones). Please see also this very recent thread on how to find duplicates.  

Christian

Hi Christian,

Thank you very much for the support provided.

Tharaka.