Dashboard – Smarter Duplicate Computer Detection

We’ve shipped a dashboard update that makes Duplicate Computers a lot less noisy for Windows and Linux agents.

For a while, users have been reporting machines that showed up as duplicates even though they were clearly different devices: different serial numbers, different sites, sometimes even different hardware. In most of those cases the dashboard was matching on a MAC address that wasn’t actually unique to the machine.

What was going wrong

On Windows and Linux, Watchman Monitoring treats two computers as likely duplicates when they share a hostname in the same group, or when they report the same system MAC address.

That works when the MAC really identifies the machine. It falls apart when several unrelated computers all report the same address from somewhere else on the network path, for example:

• A Cisco AnyConnect (or similar) VPN virtual adapter that reuses one MAC across many clients
• A cellular hotspot / tether whose default MAC gets picked up as the active NIC
• VMware, Hyper-V, VirtualBox, and other virtualization adapters that share well-known OUI prefixes
• Shared docks or dongles that briefly look like “the” system MAC

Separately, archived computer records were still included when building the duplicate list. That meant a wiped-and-replaced machine could keep looking like a duplicate of its own retired record, which made cleanup harder than it needed to be.

What we changed

Two focused fixes, both server-side (no agent update required):

1. Ignore known non-unique MACs. Virtual, VPN, tethering, and common hypervisor MAC patterns are no longer treated as unique device identity when checking for duplicates.
2. Exclude archived records from the duplicate candidate pool, so retired computers stop cluttering the list for active ones.

Real duplicates (same serial on Mac, or a genuinely shared MAC / hostname on Windows and Linux) still show up as before.

What you should see

If your Duplicate Computers filter has been full of VPN clients, tethered laptops, or VMware guests that weren’t actually the same machine, that list should be much shorter now.

Give it a look under your usual Duplicate Computers filter. If two different machines still look like duplicates because they share a hostname (with different serials and MACs), that matching path wasn’t part of this update – reply through Watchman Monitoring Support with examples and we’ll keep refining from there.

Thanks to everyone who sent screenshots and sample records. Those reports are what made this fix concrete.

Ian, Garrett & Allen