Device Computer name change

soup_dragon — Fri, 29 May 2020 12:22:30 GMT

Couple of issues encountered with AMP.

Had a computer that has disappeared from Computer Management. When I have checked in the audit log AMP has changed the computer for reasons unknown to another computer which already had AMP installed for no obvious reason. So I know have no 554 and 533 has taken on the events of 554. Further 554 was isolated and when this happened 554 became isolated and 533 isolated.

The only thing I can think may be a contributing factor is AMP is part of a gold image deployed to our devices. However, if that was the case it would happen a lot!

Any thoughts appreciated.

Re: Device Computer name change

Matthew Franks — Fri, 29 May 2020 13:10:34 GMT

If AMP on the golden image was able to register before being deployed, a duplicate guid could cause this issue, and a larger issue as you alluded to. I would check C:\Program Files\Cisco\AMP\local.xml on each machine. If the <uuid> field matches, you have a problem with your golden image process.

Thanks,
Matt

topic Re: Device Computer name change in Endpoint Security

Device Computer name change

Re: Device Computer name change