Sophos Central was uninstalled completely from a device yesterday. Today, Sophos Central indicates the status of the device as follows:
Isn't this a little misleading? The only thing accurate about the reported status is that it has been offline for 18 hours.
Thank you for reaching the community forum.
By default, this should no longer show active after you uninstall endpoint software on the device, but based on what I can see on the screenshot you've shared. The components were still there, but the AV protection wasn’t installed. It's like unfinished installed software. To further check, can you validate on the endpoint side if it has been uninstalled? You can try running Sophos Zap.
In addition, kindly check if there are duplicate device entries on your Sophos central this happens most likely if you clone one system to another.
