When reviewing a computer report or while editing a computer, it is noticed that certain computers have had their Status unexpectedly changed to Active, often when it was previously Retired.
There are several ways a computer's Status can change to Active, which may seem unexpected or automatic to the user. These include:
Cause: The computer is being managed by a Symantec Management Agent and it checked in, which automatically changes the computer's Status to Active. Solution: A Symantec Management Agent will always change the computer's Status to Active, even if the user doesn't wish this to change. The only way to prevent this is to uninstall the Symantec Management Agent. If the computer is retired, this is part of the retirement process. Refer to the following article for more information about how to retire a computer:
If another Status value, such as In Stock, is instead needing to be used, the only way to leave the change permanently there is to uninstall the Symantec Management Agent on the computer to prevent it from checking in and automatically setting the Status value back to Active. The Symantec Management Agent takes control of the Status field and forces the value back to Active. There is no method of disabling this from being automatically changed by the Symantec Management Agent.
If computers are being managed by a Symantec Management Agent but aren't actually being used be a user, such as for the purpose of keeping them patched and updated, while awaiting final deployment, these will still check in and change their Status value to Active, possibly changing from In Stock or another user-selected Status value. This is incorrect use of the Status value as because the Symantec Management Agent forces the change back to Active. Instead, find an alternative way of tracking these types of computers, such as adding a comment.
Note: If reports, especially IT Analytics reports, are being used to monitor asset status changes, these may be inaccurate because of this. For example, IT Analytics requires its cubes to be frequently processed to obtain current data. If the status of a computer is in question, check it directly by editing the asset. If this is active but a report then shows it as retired, for example, then the report is incorrect. Process the IT Analytics cubes (if this is an IT Analytics report) or correct the report's SQL/logic to resolve its data discrepancy.
Cause: Replication changed the Status of computers to Active or the Symantec Management Agent checks in on the Parent and changes the Status to Active. Solution: If there is a hierarchy and replication is used, it's possible that computer Status values may be part of the replication. Check Settings > Notification Server > Hierarchy, and then click on to expand the folder Replication. If this is configured for replication and Status is being replicated, this can result in Status several issues. Also, the Symantec Management Agent can check in and cause a similar issue. These are further discussed, with workarounds in the following articles:
Cause: The affected computers were merged with other computers that had been active. Solution: If a computer merge occurred and the Status of the other computer was kept and it was Active, then the affected computer retains this and it becomes active. Check Manage > Jobs and Tasks, and then click on to expand the folders System Jobs and Tasks > Service and Asset Mangement > CMDB, and then click on Duplicate Computer Merge and then on Resource Merge Rule. If either are enabled, these could have been the cause. In SQL Server Management Studio, run the following SQL script to check if specific computers were merged:
USE Symantec_CMDB SELECT _eventTime 'Merged Date', Resource1Name 'Merged To (Kept) Resource Name', Resource1Guid 'Merged To GUID', COALESCE(ib.Barcode, '') 'Barcode Kept', COALESCE(isn.[Serial Number], '') 'CMDB Serial Number Kept', COALESCE(ii.[System Number], '') 'CMDB System Number Kept', Resource2Name 'Merged (Removed) Resource Name', Resource2Guid 'Merged (Removed) Resource Guid' FROM Evt_Resource_Merge erm LEFT JOIN Inv_Barcode ib ON ib._ResourceGuid = erm.Resource1Guid LEFT JOIN Inv_Serial_Number isn ON isn._ResourceGuid = erm.Resource1Guid LEFT JOIN Inv_Identity ii ON ii._ResourceGuid = erm.Resource1Guid ORDER BY 1 DESC
Check an affected comupter's Resource Change History. In a computer report, right click on the computer and choose CMDB Functions > Resource Change History. In the history list, look for entries that refer to the Asset's Status. These will include the user account or process that initiated the change, along with the date and time the change occurred on.
In SQL, search the Evt_NS_Item_Management table for Status changes. This table's data may not be very clear on what happened, but it can at least show changes that occurred that can possibly be later tracked down. In SQL Server Management Studio, run the following SQL script to check activities for a specific computer:
USE Symantec_CMDB SELECT * FROM Evt_NS_Item_Management WHERE ItemName = '<computer name>' -- Change "<computer name>" to the name of the computer to check. ORDER BY _eventTime DESC
Also in SQL, search the ResourceAssociationHistoryDelta table for Status changes. For example:
USE Symantec_CMDB SELECT DISTINCT COALESCE(vcc.Name, '(Computer was Deleted or Merged)') 'Computer', rahd.ParentResourceGuid 'GUID', rahd.CreatedDate 'Changed On', vfas.Name 'Changed To' FROM ResourceAssociationHistoryDelta rahd LEFT JOIN vCMDBComputer vcc ON vcc.Guid = rahd.ParentResourceGuid JOIN vFixedAssetStatus vfas ON vfas._ResourceGuid = rahd.ChildResourceGuid WHERE ResourceAssociationTypeGuid = '3028166F-C0D6-41D8-9CB7-F64852E0FD01' ORDER BY 3 DESC