Device Computer name change

[soup_dragon]

Couple of issues encountered with AMP.

Had a computer that has disappeared from Computer Management. When I have checked in the audit log AMP has changed the computer for reasons unknown to another computer which already had AMP installed for no obvious reason. So I know have no 554 and 533 has taken on the events of 554. Further 554 was isolated and when this happened 554 became isolated and 533 isolated. 

The only thing I can think may be a contributing factor is AMP is part of a gold image deployed to our devices. However, if that was the case it would happen a lot!

Any thoughts appreciated.

[Matthew Franks · Accepted solution]

If AMP on the golden image was able to register before being deployed, a duplicate guid could cause this issue, and a larger issue as you alluded to.  I would check C:\Program Files\Cisco\AMP\local.xml on each machine.  If the <uuid> field matches, you have a problem with your golden image process.

Thanks,
Matt