Active scanning picking computers not logged on

[fjca]

Hello,

We do a lot of moving in our enviroment, and since a few months ago (I think it was when I upgraded to 4.2.0.77, but I'm not sure), we started to see computers that where decommissioned, moved, or had their name changed popping up again in Lansweeeper.

On the first days that is expected, because of the service restart that picks changes on the last 15 days, but them we would delete them and they would not reappear. But now they do...

These are computers that for one reason or another are not yet deleted/disabled from AD, but they haven't logged on also...

So, it seems that Lansweeper is picking up *ALL* computers in AD, not just the recently logged on ones.

I know the best solution is to delete/disable the machines, but this was not Lansweeper behavior until a few months/releases ... is something changed in the way that Active scanning works and detects new computers ?

[Hemoco]

Please contact us at support@lansweeper.com and provide us with the following:
- For easy reference, a link to this forum thread.
- The Errorlog.txt file located in Program Files (x86)\Lansweeper\Service on your Lansweeper server.
- Output of the report below, preferably in Excel format. Replace YourComputer with the NetBIOS name of one machine that you deleted and that popped up again.

Select Top 1000000 tblComputers.ComputerUnique, tblComputers.Computername, tblComputers.Computer, tblComputers.Domain, tblComputers.LastknownIP, Web40OSName.OSname, Web40OSName.SP, Web40OSName.OScode, tblComputers.Scanserver, tblComputers.Firstseen, tblComputers.Lastseen, tblComputers.Lasttried, tblComputers.Lasttriggered, tblComputers.LastScheduled, tblComputers.LastActiveScan, tsysASDomains.Servername, tsysASDomains.Domainname, tsysASDomains.Netbiosname, tsysASDomains.Firsttime, tblComputers.LastLsPush, tsysIPScanRanges.Servername As Servername1, tsysIPScanRanges.Ipstart, tsysIPScanRanges.Ipend, tsysIPScanRanges.Enabled, tsysIPScanRanges.DefaultDomain, tsysIPScanRanges.DefaultDomain2, tsysIPScanRanges.DefaultDomain3, tsysIPScanRanges.IPIgnoreWindows, tsysIPScanRanges.Day1, tsysIPScanRanges.Day2, tsysIPScanRanges.Day3, tsysIPScanRanges.Day4, tsysIPScanRanges.Day5, tsysIPScanRanges.Day6, tsysIPScanRanges.Day7, tsysIPScanRanges.LastIPscan, tblerrors.CFGname, tblerrors.ErrorText, tblerrors.Lastchanged From tblComputers Left Join tsysASDomains On tsysASDomains.Netbiosname = tblComputers.Domain Left Join Web40OSName On Web40OSName.Computername = tblComputers.Computername Left Join tblerrors On tblComputers.Computername = tblerrors.Computername, tsysIPScanRanges Where tblComputers.Computer = 'YourComputer' Order By tblComputers.ComputerUnique

[fjca]

Lansweeper wrote:
Please contact us at support@lansweeper.com and provide us with the following:
- For easy reference, a link to this forum thread.
- The Errorlog.txt file located in Program Files (x86)\Lansweeper\Service on your Lansweeper server.
- Output of the report below, preferably in Excel format. Replace YourComputer with the NetBIOS name of one machine that you deleted and that popped up again.

Hello, sorry for taking this long to answer, but budgets haven taken all my time those two last weeks.

I've run this report agains several computers, both new and old, and it always cames up empty. I'm not a SQL guru, so I cannot see what is wrong it it...

[Hemoco]

fjca wrote:

Lansweeper wrote:
Please contact us at support@lansweeper.com and provide us with the following:
- For easy reference, a link to this forum thread.
- The Errorlog.txt file located in Program Files (x86)\Lansweeper\Service on your Lansweeper server.
- Output of the report below, preferably in Excel format. Replace YourComputer with the NetBIOS name of one machine that you deleted and that popped up again.

Hello, sorry for taking this long to answer, but budgets haven taken all my time those two last weeks.

I've run this report agains several computers, both new and old, and it always cames up empty. I'm not a SQL guru, so I cannot see what is wrong it it...

Could you contact us at support@lansweeper.com and provide us with the following instead:
- Output of the revised report below, preferably in Excel format. Replace YourComputer with the NetBIOS name of one machine that you deleted and that popped up again.
- For easy reference, a link to this forum thread.
- The Errorlog.txt file located in Program Files (x86)\Lansweeper\Service on your Lansweeper server.

Select Top 1000000 tblComputers.ComputerUnique, tblComputers.Computername, tblComputers.Computer, tblComputers.Domain, tblComputers.LastknownIP, Web40OSName.OSname, Web40OSName.SP, Web40OSName.OScode, tblComputers.Scanserver, tblComputers.Firstseen, tblComputers.Lastseen, tblComputers.Lasttried, tblComputers.Lasttriggered, tblComputers.LastScheduled, tblComputers.LastActiveScan, tsysASDomains.Servername, tsysASDomains.Domainname, tsysASDomains.Netbiosname, tsysASDomains.Firsttime, tblComputers.LastLsPush, tblerrors.CFGname, tblerrors.ErrorText, tblerrors.Lastchanged From tblComputers Left Join tsysASDomains On tsysASDomains.Netbiosname = tblComputers.Domain Left Join Web40OSName On Web40OSName.Computername = tblComputers.Computername Left Join tblerrors On tblComputers.Computername = tblerrors.Computername Where tblComputers.Computer = 'YourComputer' Order By tblComputers.ComputerUnique

[Hemoco]

If you are not using your cleanup options to delete these machines, could you clarify which steps you are taking to manually delete them.

[fjca]

Lansweeper wrote:
If you are not using your cleanup options to delete these machines, could you clarify which steps you are taking to manually delete them.

I deleted them in Lsmanage, Lsmanage->Scanned Computers->Delete.

[MrVal]

Thats acctually the way active scanning has always worked for me.

If you only want it to scan durring login you'll probably want to create a logon script in AD and use LSpush.

[fjca]

MrVal wrote:
Thats acctually the way active scanning has always worked for me.

If you only want it to scan durring login you'll probably want to create a logon script in AD and use LSpush.

But not for us, we never had zombie machines popping up from the ground 🙂

If we deleted a old machine in Lansweeper (BUT not from the AD), that machine would not re-appear , and now it does, after one day or two... I can only fully erase them if I disabled or deleted on the AD...

Also, what is the lead time for picking up deleted machines ?

I deleted one today and two hours after it was still listed as active... Unfortunately work caught up with me and I could only check later in the day, and 8 and a half hours after, it was already listed as non-active...

[Hemoco]

Active Scanning only picks up machines that have reported to your domain controllers and that have not been scanned in the last 20 hours.

fjca wrote:
I deleted one today and two hours after it was still listed as active... Unfortunately work caught up with me and I could only check later in the day, and 8 and a half hours after, it was already listed as non-active...

Could you clarify how you tried to delete the machine. The machine being set to non-active was probably caused by one of the cleanup options listed in the Lansweeper configuration console under Scanning Servers\(name of your server)\Options\Scanning & Cleanup Options.

[fjca]

Lansweeper wrote:
Active Scanning only picks up machines that have reported to your domain controllers and that have not been scanned in the last 20 hours.

fjca wrote:
I deleted one today and two hours after it was still listed as active... Unfortunately work caught up with me and I could only check later in the day, and 8 and a half hours after, it was already listed as non-active...

Could you clarify how you tried to delete the machine. The machine being set to non-active was probably caused by one of the cleanup options listed in the Lansweeper configuration console under Scanning Servers\(name of your server)\Options\Scanning & Cleanup Options.

Hello, regarding the first question, what is happening in my enviroment is :

- Machine A is decomissioned and taken for storage. It is not powered on,
not connected to the network, it just sits there waiting to be wiped
and sent to charity.
- Machine A is deleted in Lansweeper, but not on the AD.
- After a few hours, two days maximum, machine A reapperas in Lansweeper.
- Machine A gets deleted again in Lansweeper, but not on the AD
- After a few more hours, two days maximum, it reappears again.

This happens without LS service restarts, and we confirmed on the AD
that the last logon time for the machine was when it was turned off.

Regarding the second question, I deleted the machine on the AD, and them
checked to see when it would get flaged as non-active on Lansweeper.
It took between 2 and 8.5 hours in this case.

Our clean-up options are to place all machines not scanned after 180 days
with a non-active status. We do not delete machines automatically.

Has I said, this is not a major issue for us since our standard procedure
is to delete all machines that are decomissioned, but of course there
are always a few exceptions, and that's a behavior we had not seen on
older versions.