Uninstalled Agents data is missing from Forensic Query (NETIQKB71536)

  • 7771536
  • 17-Apr-2009
  • 28-Sep-2009

Environment

Security Manager 6.x

Situation

When an Agent in uninstalled (not deleted) you can no longer view data in forensic queries from that agent. The following information is displayed:

Some of the report results have been filtered out because of your permission settings.

Resolution

  • Open the Security Manager Monitor Console.
  • Launch the Agent Administrator.
  • Select Agent Summary and then Agent Summary View.
  • Inside the Agent Summary View:
    • Place a check in show hidden computers.
    • Find the uninstalled agent in the list.
    • Find the hidden column and set the option to "No".
    • Click Apply and Close.
    • Place a check in Apply configuration changes now and click ok.

Cause

When an agent is uninstalled the hide flag is enabled on the agent. This flag effects the security permissions on the agent and also makes it's event data hidden from all views.

Additional Information

Formerly known as NETIQKB71536

The hidden agent setting also effects existing completed forensic queries. Existing completed forensic queries will be updated automatically with the changing of the hidden flag on each uninstalled agent.