- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-29-2020 05:22 AM
Couple of issues encountered with AMP.
Had a computer that has disappeared from Computer Management. When I have checked in the audit log AMP has changed the computer for reasons unknown to another computer which already had AMP installed for no obvious reason. So I know have no 554 and 533 has taken on the events of 554. Further 554 was isolated and when this happened 554 became isolated and 533 isolated.
The only thing I can think may be a contributing factor is AMP is part of a gold image deployed to our devices. However, if that was the case it would happen a lot!
Any thoughts appreciated.
Solved! Go to Solution.
- Labels:
-
AMP for Endpoints
Accepted Solutions

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-29-2020 06:10 AM
If AMP on the golden image was able to register before being deployed, a duplicate guid could cause this issue, and a larger issue as you alluded to. I would check C:\Program Files\Cisco\AMP\local.xml on each machine. If the <uuid> field matches, you have a problem with your golden image process.
Thanks,
Matt

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-29-2020 06:10 AM
If AMP on the golden image was able to register before being deployed, a duplicate guid could cause this issue, and a larger issue as you alluded to. I would check C:\Program Files\Cisco\AMP\local.xml on each machine. If the <uuid> field matches, you have a problem with your golden image process.
Thanks,
Matt
