Duplicate computer names in client view

[JamesThom]

I have working through trying to determine where my 600 or unregistered clients are. It seems a fair portion are shown in the client view in duplication.

 

What I will see is a machine that is installed and reporting fine and next to it in the list is the same machine name as unregistered. I took a look at my AD structure as I know the MBAM server syncs every 10 minutes but don't see anything amiss there.

 

Any insight as to why I might see this sort of duplication or what I can do about it?

 

 

[Lazz]

Hi James!

 

On the client that is duplicated (the one showing as online) which version of the managed client is it on?  If this is not listed in your client view, right-click on the columns above and choose "Customize columns" then choose "Managed Client"

[greg9021]

I aswell just realised I have multiple clients with 2 entries under the client tab. Most of them are laptops.

One is online and the duplicate is off. The duplicate shows blank in the the managed client versions field.

It is strange because they have different ip addresses and the physical address is different aswell.

 

Posible old dns information?

[Lazz]

If the computers' information has changed, this could cause the duplicate entry.

 

Also, if the Managed Client version field is empty, they may be on an older version.  With version 1.3 and higher you can view which Managed Client version is on each client.

 

Greg, can you tell me which version of MEE you are running?

[greg9021]

1.3.1.1962

[Lazz]

Greg,

 

You should be OK to right-click on the duplicates and remove them, as it could just be an old registration.  

 

I would recommend monitoring to see if these duplicates come back, however.  In that case we would need to investigate a little more.

[greg9021]

Ok thank you.

[greg9021]

Upon further inspection I noteced multiple liscenses were being used for the same device. I have a server with 2 ip's, one facing the DMZ and the other for the LAN.

The LAN spiceworks client is green while the DMZ is red.

 

My questions are:

 

1. Why does MBAM use more than one liscense on a client

2. Why does it regester clients with more than one ip as a duplicate?

 

Thanks

[Lazz]

Hi Greg,

 

There are two things about this situation.

 

The first solution would be to uninstall the MEE client from this server, as Malwarebytes is not designed to be installed on servers and is not supported.

 

However, if you wish to keep it on this server, a solution that may work is to add a firewall rule that prevents that IP from accessing the server with the client communication port (default 18457 in setup.)