Report to find duplicate Symantec Endpoint Protection Hardware keys

[john_e_wagner]

Hi-

I am having an issue with Symantec in that some of our images were not sysprepped before deployment. The unique SEP HWID is duplicated causing SEP to process several computers as one computer. I created a registry scan for the hkey_local_machine hive for SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink for the value HardwareID.

I created a report that lists all of the keys, but I am having trouble removing the NON-duplicated HWID field from the report.

I have the report with this select

"
Select Top 1000000 tblComputers.ComputerUnique, tblComputers.Domain, tblComputers.Username, tblRegistry.Valuename, tblRegistry.Value From tblComputers Inner Join tblRegistry On tblComputers.Computername = tblRegistry.Computername Where tblRegistry.Valuename = 'HardwareID' Order By tblRegistry.Value
"

When I try to add "And Count(tblRegistry.Value) > 1" to the where cause I get an error. I know this is pretty simple, but I'm just not seeing it.

Thanks for any help in advance,

JW

[Hemoco · Accepted solution]

Could you try the report below instead.

Select Distinct Top 1000000 tblComputers.Computername,
tblComputers.ComputerUnique, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername Inner Join
(Select Top 1000000 Count(tblRegistry.RegistryID) As Total, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink' And
tblRegistry.Valuename = 'HardwareID'
Group By tblRegistry.Value
Having Count(tblRegistry.RegistryID) > 1) Duplicates On tblRegistry.Value =
Duplicates.Value
Order By tblRegistry.Value

[john_e_wagner]

Not quite what I'm looking for. That report gives me duplicated key counts. I need the computers that have a non unique hwid key.

JW

[Hemoco]

Could you try the report below.

Select Top 1000000 tblRegistry.Regkey, tblRegistry.Valuename, tblRegistry.Value, Count(tblRegistry.Computername) As Total From tblRegistry Group By tblRegistry.Regkey, tblRegistry.Valuename, tblRegistry.Value Having tblRegistry.Regkey = 'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink' And tblRegistry.Valuename = 'HardwareID' And Count(tblRegistry.Computername) > 1 Order By Count(tblRegistry.Computername) Desc