Computers incorrectly listed in the console as having errors

  • Article ID: 117793
  • Updated: 16 Apr 2013

Issue

When selecting a filter such as 'Managed computers with outstanding Sophos product errors' a number of computers are listed that have no reported errors.

First seen in

Enterprise Console 4.0.0

Cause

These endpoints had had Sophos compliance agent (NAC) installed, the agent reported an error but was subsequently uninstalled.

What To Do

To confirm the solution in this article applies, you should run the below command:

  1. Start | Run | Type: cmd.exe | Press Enter.

  2. Execute the following command (all one line):
    SQLCMD -E -S (local)\SOPHOS -d SOPHOS50 -Q "SELECT Name FROM dbo.ComputersAndDeletedComputers WHERE NacAssessmentResult=2"
    Where:
    • (local)\SOPHOS represents a local SOPHOS named SQL Server instance.  For more information of determining the SQL instance name in use, see article: 113030.
    • SOPHOS50 represents the name of the 'Core' database of an Enterprise Console 5.0 installation.  For more information on the appropriate database name for each version of Enterprise Console see article: 17323.

If the out list of computers from the above command matches the computers that are known to have the issue and the Sophos compliance agent is no longer used on your network then please follow the below steps to resolve the issue.

Solution 1

Upgrade to Enterprise Console 5.1 or later.  The purge task run by the Sophos Management Service every 24 hours will resolve the problem.  Otherwise you can manually use the PurgeDB tool to safely remove these entries from the database. For more information on PurgeDB see article 109884.

Solution 2
This method requires direct access to the database and miss typing of the command could potentially cause a database corruption; we therefore suggest you only follow these steps if you are unable to upgrade to Enterprise Console 5.1 or later.

Before attempting these steps, please backup your database . For steps on how to do this see article 110380.

  1. Click: Start | Run Type: cmd.exe | Press Enter.

  2. Execute the following command (all one line):
    SQLCMD -E -S .\SOPHOS -d DatabaseName -Q "UPDATE dbo.ComputersAndDeletedComputers SET NacAssessmentResult=0 WHERE NacAssessmentResult > 0 AND ID NOT IN (SELECT ComputerID FROM dbo.ComputerPolicyStates WHERE Type=8)"
    Where:
    • (local)\SOPHOS represents a local SOPHOS names SQL Server instance.  For more information of determining the SQL instance name in use see article: 113030.
    • SOPHOS50 represents the 'Core' database of an Enterprise Console 5.0 installation.  For more information on the appropriate database name for each version see article: 17323.

 
If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent

Comments