I currently have an open case with Symantec about this, but they are taking too long for my liking. Here is the background...
We are running a nightly discovery against AD to find all computers. We are then automatically pushing the Symantec agent out to all machines showing in the without agent installed filter. That all works pefectly fine. The problem is when we reimage a computer. They still show as having the agent installed in the console when it no longer is. We do not have the Symantec agent installed on any of our images.
Symantec decided to create a new filter to list all computers that had not communicated with the server for 24 hours. That filter could then be added in to the automatic push so it would attempt to reinstall the agent on those machines. I'm not 100% sure this is what I want to do, but it seems like it will work to take care of the issues we have with getting the agent installed after reimaging. We never had this problem with NS 6.5 prior to migrating to CMS 7.1. Of couse...we also installed the Altiris agent via GPO then. We are no longer doing that since the migration to CMS 7.1.
So Symantec helped me write a new filter. Every time I try to update the results, though, I get the following error message:
"Error updating the filter membership. Please ensure the first column returned from the query is of type GUID."
I have searched and found this same error, but it is a known issue with 7.0 SP2 that was supposed to be resolved in 7.0 SP3. It also happens when creating a new filter using Query Builder mode. I am creating my filter using Raw SQL. Here is the SQL entry I am attempting to use:
DECLARE @TrusteeScope AS nvarchar(max)
SET @TrusteeScope = '{2E1F478A-4986-4223-9D1E-B5920A63AB41},{582029E2-FC5B-4717-8808-B80D6EF0FD67},{727546B7-D87F-4E70-93C2-EF2853A70046},{B760E9A9-E4DB-404C-A93F-AEA51754AA4F}'
DECLARE @Last_Modified_At_Least_N_Hours AS INT
SET @Last_Modified_At_Least_N_Hours = 24
SELECT DISTINCT
vc.[Name] AS [Name],
vc.[Description] AS [Description],
[AeX_AC_Identification].[OS Name] AS [OS Name],
[AeX_AC_TCPIP].[Primary DNS Suffix] AS [Primary DNS Suffix],
rus.[CreatedDate] AS [Date Created],
rus.[ModifiedDate] AS [Date Modified],
DATEDIFF(hh, rus.[ModifiedDate], GETDATE()) AS [Hours Since Last Modified]
FROM
[vRM_Computer_Item] AS vc
LEFT OUTER JOIN [Inv_AeX_AC_Identification] AS [AeX_AC_Identification]
ON vc.[Guid] = [AeX_AC_Identification].[_ResourceGuid]
LEFT OUTER JOIN [Inv_AeX_AC_TCPIP] AS [AeX_AC_TCPIP]
ON vc.[Guid] = [AeX_AC_TCPIP].[_ResourceGuid]
LEFT OUTER JOIN (
SELECT DISTINCT ResourceGuid, MAX(CreatedDate) CreatedDate, MAX(ModifiedDate) ModifiedDate
FROM [ResourceUpdateSummary]
GROUP BY ResourceGuid
) AS rus
ON vc.[Guid] = rus.[ResourceGuid]
INNER JOIN [fnGetTrusteeScopedResources](@TrusteeScope) AS [fnGTSR_5]
ON [vc].[Guid] = [fnGTSR_5].[ResourceGuid]
WHERE
@Last_Modified_At_Least_N_Hours >= DATEDIFF(hh, rus.[ModifiedDate], GETDATE())
I am going to be honest, I absolutely cannot write a SQL report to save my life. This is basically data from a canned report that has been modified to fit my needs. If anybody can shed any light on this for me I would greatly appreciate it. Symantec is working on the issue, but they're taking a little longer then I would like. I just reimaged an entire lab today so I now have those 35 machines no longer communicating with the CMS server. They show as having the agent installed so it will not install the agent again. I know I could just delete them so they would get re discovered, but that defeats the purpose. We have 8,000 workstations and multiple technicians that reimage computers every day. That would require the CMS admin (me) to know every single computer that was reimaged so it could manually be deleted. That, obviously, is not a viable solution.