SCCM Computer Identity changing serial numbers, names, back and forth?

[Matt C]

Struggling with an odd one here... We have SCCM 2012 computer identity coming in.

The Transform Map is actually built to coalesce on ServiceNow sys_id, with a lot of supporting logic/script.

There are a number of cases now, where we find basic computer information such as serial number, chassis type, model, and name flip flopping back and forth and back and forth again.

A view of the CI record: It shows Sources (2) where two SCCM entries with unique Correlation IDs (Resource IDs) are reported

And a further look into the audit history of this CI to illustrate these basic fields that keep flip flop changing back and forth:

CI Audit history list:

Is this a simple case of multiple Correlation IDs coming from SCCM, perhaps due to re imaging of the machine, or other types of typical work?

Suggested logic to prevent this?

Thanks for all ideas

[Sam Ogden]

Hi Karlie,

Unfortunately I've changed roles since then.  I don't recall getting a fix for this before I left.  

Thanks

Sam

[Ian Mildon]

It's been a while since I've done anything on this but after a combination of deactivating the bad OID's, tweaking my classification rules and getting updated OID's, it doesn't appear to be an issue now.

Or if it is still an issue, no-one has noticed yet. Guess I need to go take another look now!

[pbostian]

we had EXACTLY the same issues... Had been making all the appropriate reconciliation rules, and not understanding why SCCM and Discovery were fighting.  We have been updating the CMDB identifiers, but the system was still set to use the CI identifiers.... need to set the appropriate system property (glide.discovery.use_cmdb_identifiers)  to TRUE.  that fixed the issue for us.  Months of frustration and confusion, and it was one simple sys_property.

[Ian Mildon]

We actually ran into multiple issues affecting both SCCM and Discovery:

1. AIX servers being classified as IP Routers

Change the "Classification Priority" in the "discovery_port_probe" table so that SSH is triggered ahead of SNMP and this should fix your issue

2. Windows Servers being classified (flipping) between Windows Servers, Printers, IP Routers

https://hi.service-now.com/problem.do?sysparm_query=number=PRB1408983

Issue is 3 "bad" OID records, need to deactivate them

[UndertoadNW]

In SCCM the Correlation ID (Resource ID in SCCM) can change if the computer is reimaged, or sometimes just if someone redeploys the local SCCM app to resolve some other issue (maybe it is not reporting). 

In this SCCM history log from an affected computer, you can see that the laptop linked to the Correlation ID changed on 08/31/2023 from XXXXXX00L to XXXXXX93L when we reimaged the device. 

After this date, the Correlation ID refers to a different device.  Afterwards, our SNOW logs show it switches to the old computer and then to the new computer every night, when we synch.

Do you have any idea how to correct affected computers?  We've tried editing the cmdb_serial_number.list and the computer records themselves, but they just switch back.  Any idea how can we associate the new Correlation ID with XXXXXX00L ?