Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Subscribers 1 subscriber
  • Views 21047 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Join an existing Sophos Anti-Virus Client from workgroup to a domain

Auto_Humanitas

Hello,

We use SEC 5.2.1 R2 and Sophos Anti-Virus 10.3.7.

We have a laptop that was in a workgroup but move to another place where we wanted to join it to a domain. On the Active Directory OU we have a auto sync so after we joined the laptop to the domain a new (unprotected) client appeared in the console.

Now 2 clients show up in the console:

1. Connected, protected client in the workgroup (old config)

2. Not connected or protected client in AD. (new config)

But offcourse it should be the other way around. It WAS part of a workgroup but now we joined it to the domain so the domain client should show up as connected and protected.

I tried deleting the workgroup client. I tried uninstalling en re-installing but it's still the same.

How can we resolve this so the client that is synchronised through AD is the one that is connected and we can delete the old workgroup installation?

Any help would be greatly appreciated!

:50692


This thread was automatically locked due to age.
Parents
  • 0

    Hello Peter,

    I see.  Dunno what could cause this misbehaviour (it might be interesting to find out so that future occurrences can be avoided).

    Start with the Network Communications Report on the endpoint (open ReportData.xml in %ProgramData%\Sophos\Remote Management System\3\Router\NetworkReport\ with a browser) and check if the domain is correct in Computer Details and make note of the RMS-Routername.

    Next take a look at the entries in the database (puts the output to a file named with the -o flag)::

    sqlcmd -E -S .\SOPHOS -d SOPHOS521 -Q "Select ID,Name,DomainName,Managed,Deleted,InsertedAt,LastMessageTime,MessageSystemAddress,IdentityTag from ComputersAndDeletedComputers where Name='NB2455'" -o outputfile.txt

     There could be more than two entries, the MessageSystemAddress corresponds to the RMS-Routername. Dunno if this will shed any light on it though.

    Christian

    :50932
Reply
  • 0

    Hello Peter,

    I see.  Dunno what could cause this misbehaviour (it might be interesting to find out so that future occurrences can be avoided).

    Start with the Network Communications Report on the endpoint (open ReportData.xml in %ProgramData%\Sophos\Remote Management System\3\Router\NetworkReport\ with a browser) and check if the domain is correct in Computer Details and make note of the RMS-Routername.

    Next take a look at the entries in the database (puts the output to a file named with the -o flag)::

    sqlcmd -E -S .\SOPHOS -d SOPHOS521 -Q "Select ID,Name,DomainName,Managed,Deleted,InsertedAt,LastMessageTime,MessageSystemAddress,IdentityTag from ComputersAndDeletedComputers where Name='NB2455'" -o outputfile.txt

     There could be more than two entries, the MessageSystemAddress corresponds to the RMS-Routername. Dunno if this will shed any light on it though.

    Christian

    :50932
Children
No Data