→ Celebrate SysAdmin Day 2024 with Lansweeper Enter our Giveaway here

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
john_e_wagner
Engaged Sweeper II
Hi-

I am having an issue with Symantec in that some of our images were not sysprepped before deployment. The unique SEP HWID is duplicated causing SEP to process several computers as one computer. I created a registry scan for the hkey_local_machine hive for SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink for the value HardwareID.

I created a report that lists all of the keys, but I am having trouble removing the NON-duplicated HWID field from the report.

I have the report with this select

"
Select Top 1000000 tblComputers.ComputerUnique, tblComputers.Domain, tblComputers.Username, tblRegistry.Valuename, tblRegistry.Value From tblComputers Inner Join tblRegistry On tblComputers.Computername = tblRegistry.Computername Where tblRegistry.Valuename = 'HardwareID' Order By tblRegistry.Value
"

When I try to add "And Count(tblRegistry.Value) > 1" to the where cause I get an error. I know this is pretty simple, but I'm just not seeing it.

Thanks for any help in advance,

JW
1 ACCEPTED SOLUTION
Hemoco
Lansweeper Alumni
Could you try the report below instead.

Select Distinct Top 1000000 tblComputers.Computername,
tblComputers.ComputerUnique, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername Inner Join
(Select Top 1000000 Count(tblRegistry.RegistryID) As Total, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink' And
tblRegistry.Valuename = 'HardwareID'
Group By tblRegistry.Value
Having Count(tblRegistry.RegistryID) > 1) Duplicates On tblRegistry.Value =
Duplicates.Value
Order By tblRegistry.Value

View solution in original post

3 REPLIES 3
Hemoco
Lansweeper Alumni
Could you try the report below instead.

Select Distinct Top 1000000 tblComputers.Computername,
tblComputers.ComputerUnique, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername Inner Join
(Select Top 1000000 Count(tblRegistry.RegistryID) As Total, tblRegistry.Value
From tblComputers Inner Join
tblRegistry On tblComputers.Computername = tblRegistry.Computername
Where
tblRegistry.Regkey =
'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink' And
tblRegistry.Valuename = 'HardwareID'
Group By tblRegistry.Value
Having Count(tblRegistry.RegistryID) > 1) Duplicates On tblRegistry.Value =
Duplicates.Value
Order By tblRegistry.Value
john_e_wagner
Engaged Sweeper II
Not quite what I'm looking for. That report gives me duplicated key counts. I need the computers that have a non unique hwid key.

JW
Hemoco
Lansweeper Alumni
Could you try the report below.

Select Top 1000000 tblRegistry.Regkey, tblRegistry.Valuename, tblRegistry.Value, Count(tblRegistry.Computername) As Total From tblRegistry Group By tblRegistry.Regkey, tblRegistry.Valuename, tblRegistry.Value Having tblRegistry.Regkey = 'HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink' And tblRegistry.Valuename = 'HardwareID' And Count(tblRegistry.Computername) > 1 Order By Count(tblRegistry.Computername) Desc