These last few weeks we've had about 10 cases where machines get a second agent installed without actions by us or the customer. It's the same hardware, the same physical machine. The only thing we see, is a different MAC Address for these two agents. So, Kaseya somehow decides to install an agent on a machine
So, does anyone recognize this in any way? We started a ticket for this, but I'm not holding my breath for an explanation. The first reaction was to remove the second agent and forget about it.... :-(
It's not connected to one customer, it's not connected to policies rolling out agents, it doens't seem to be connected to any action by us or the customer. Just random cases of extra agents. Investigating one of these cases leads to an interesting fact. The original agent on a machine has been there for weeks. Just recently a new agent reported coming online for the first time, but 16 hours prior that same agents has entries in it's Agent, Agent Admin Logs and one of the first lines in the log says the agent was even started 8 hours before that, so a full day before the agent was supposed to come online for the first time.
Confused? Yep! Wondering why? Yep! Any thoughts or theories?
How do you show the duplicates? Do you have an automated mechanism or do you simply run a visual check after sorting by name?
Are both Online ?
Do you have a Group Policy deploying agents
Is the Deployment Package Set to Overwrite any existing agents
When a new agent comes online, we receive an email that tells us to administratively fix some Custom Fields.
There are a dozen or so new agents every week, something like that. When things go wrong it's usually with new agents, so we routinely have someone check settings and if monitor sets, KAM, KAV and Patch Management and such is setup and working.
For most cases both are online and there is a second agent installation on those machines with their default kworking and kworking1 folders. We have ruled out Group Policy options and our Deployment Packages are default setup to overwrite existing agents. But we also checked no one did deploy any agent.
Our most important lead on this is the difference in MAC address for both agents.
Support tells us a new agent might get deployed in a situation where a machine connects through the LAN port as well as the wireless port. The different MAC address will lead to having two different agents on one machine. It's ok if that's the way it is.
Two thing that bother me with this issue. I'm not aware of anything like this happening in the past. And why does Kaseya roll out this second agent, since the customer and our team are not responsible for this action. So, it must be some kind of misfiring agent update or automated Kaseya action...