topic Re: Duplicate ID Cisco AMP in Endpoint Security

Duplicate ID Cisco AMP

RickSYS — Fri, 16 Sep 2022 15:02:46 GMT

Seeing a lot of duplicate names/IPS, we use an imaging software for the physical environment and not sure what the best practice is to make sure the machines are getting the correct name/IP for the AMP dashboard. I have found an article for the VDI environment and that works fine.

Re: Duplicate ID Cisco AMP

Ken Stieers — Fri, 16 Sep 2022 22:06:37 GMT

Look at the stuff about identity persistence and golden image stuff here. It really is much like VDI deployments.

https://www.cisco.com/c/en/us/support/docs/security/secure-endpoint/217557-cisco-secure-endpoint-guide-to-identity.html

Re: Duplicate ID Cisco AMP

chickenriceandbeans — Tue, 01 Apr 2025 11:38:44 GMT

@Ken Stieers So, in an Intune environment, if a computer comes back as a duplicate after being wiped, what should be done?

Re: Duplicate ID Cisco AMP

Ken Stieers — Tue, 01 Apr 2025 13:36:36 GMT

It really depends upon what your tenant is configured for and what Intune is installing.
If persistence is set for "By Host name across Organization" or "By Mac across Organization", and Intune is running the installer, and you use the same name, it would be fine...
If Intune is deploying an image, with AMP already installed, and you're getting duplicate GUIDs, your image needs to be configured as a golden image, as it currently has GUID and every machine is getting stamped with it.

Re: Duplicate ID Cisco AMP

chickenriceandbeans — Tue, 01 Apr 2025 13:41:03 GMT

I have By Host name across Organization, and I am wiping a computer, meaning it is completely cleaned. However, when the computer starts, it gets a new GUID. So, in this case, what kind of boot file do I need to create?

Re: Duplicate ID Cisco AMP

Matthew Franks — Tue, 01 Apr 2025 17:28:07 GMT

Are you using the same hostname? Have you looked at the install log to see if there are any indications in the logs of what is not going as expected?