Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Subscribers 15 subscribers
  • Views 11867 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Central Showing Computer That has Endpoint Removed

Leebtish

Hi all,

New to Sophos Central and Endpoint so please excuse me if this has been covered many times before :)

We are starting to migrate our PCs and servers from SEC to Central Endpoint but had an issue with one so decided to remove it. However, when I check the Central admin console it shows the computer with a nice green tick and the status has green ticks for each component. It shows the last activity was 6 hours ago so I would have thought the dashboard would show this as an alert / issue. Effectively we have an unprotected computer and Sophos Central thinks everything is fine.

Is there a threshold that central uses to decide when an alert should be raised if a computer does not update / contact central in a certain amount of time ? This is quite a concern as we have no way of knowing if what the dashboard says is correct.

Thanks for any help in advance!

Lee



This thread was automatically locked due to age.
  • 0

    Experiencing the same problem after uninstalling endpoint on a server and reinstalling on a replacement server, it has not removed the old server from sophos central.   This triggered the over licensed message on sophos central.

    So as it stands the software has been uninstalled and the server removed from the domain. 

    Hoping this will not cause licensing issues.

     

     

  • +1

    Hi  

    Uninstalling endpoint software will not automatically remove the endpoint from Central. It will still require that step from the Admin. Reason being is that automatically deleting the endpoint when the software is uninstalled would be troublesome for admins with the intention to reinstall. 

    As per the threshold, if you uninstall the endpoint software, it essentially cuts off the communication between Central and the endpoint. But it has no way of knowing whether it's due to an uninstall or because the endpoint is just turned off. So it will just show the last known information it has from it.

    The first alert you will receive would say "Computer or server out of date." You will receive this when the computer has not updated in the last 24 hours. 

    Cheers,

    Karlos

    Karlos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.
  • 0 in reply to Karlos

    Hi Karlos,

    So what you are saying is, wait 24hrs and the server will automatically remove itself?  Or the option to remove the server from sophos central will be available after 24hrs once the out of date message appears?  

    Whats the additional admin steps to remove the server from sophos central,  if you say delete the server from sophos central, there is no option to delete the server.  I can delete clients but not servers through sophos central. 

    Cheers

    Jeff

  • +1 in reply to jeffmcfarlane

    Option to delete server is under the server name. 

    Click on the server, under the server name there is a delete link. (tiny)

    Feature request - tickbox to delete server 

    Its not easy to find when under pressure and asking this forum didn't really answer the question.

    Hope people find this useful... 

  • 0 in reply to Karlos

    Thanks for the info Karlos.

Unfiltered HTML