Endpoint Protection

In the past to clear unmanaged computers from the list, the procedure I was told to do was diable the unmanaged detector and then reenable it.

That still works to clear the list, but since upgrading from 12.1.2 to 12.1.4, this procedure also clears out the list of exceptions. 

While this is the case, the entire feature is useless as I have no way of finding any new detections in such a long list, so it needs to be cleared, but in doing so, I lose every exception I painstakingly add to exclude devices that are meant to be unmanaged (switches, printers, etc).

Does anyone know of any sort of workaround that can be used to do this without purging the exceptions list as well?

To my knowledge, there is none.

You can add a product suggestion for it:

How to submit a suggestion for a Symantec security product

http://www.symantec.com/docs/TECH94818

Ideally, it would be nice to be able to import/export to a text, csv, etc.

Hello,

Here is Symantec's recommendation:

http://www.symantec.com/docs/TECH93440

You can try the option of "Delete clients that have not connected for __ days" would delete the clients which have not connected to the SEPM for "x" amount of days.

http://www.symantec.com/docs/TECH176635

Configuring a low value for this setting would clear up the enteries more quickly. 

It is important to consider clients that are offline over the weekend. Setting this value to 1 or 2 will likely cause all your clients to be removed after a weekend.

A recommended value for large enterprise environments would be 7 to 14 days.

In case, these machines are coming back on the network, in the Next Heartbeat Interval, these clients would get re-register with the SEPM.

Check this Thread with similar issue: https://www-secure.symantec.com/connect/forums/unmanaged-detector-not-reporting-unmanaged-endpoints-correctly

Hope that helps!!

Hi,

Thank you for posting in Symantec community.

Time being can take a backup of centralized exception policy prior to make any changes with unmanaged detector.

I have not seen the same issue reported issue by other customers.

SEP 12.1 RU4 is the latest version of SEP, log a case with the support team to investigate further.

How to create a new case in MySupport

http://www.symantec.com/docs/TECH58873

This issue has been reported by other customers, in fact someone just posted a link to a thread where someone says the same thing

https://www-secure.symantec.com/connect/forums/unmanaged-detector-not-reporting-unmanaged-endpoints-correctly#comment-9352081

Symantec has rendered the unmanaged detector functionality useless in ver 12.1.4a. At this point I don't know how to get to a knowledgeable person that really understands SEP Unmanged Detection and understands the gravity of the problem.

Have you opened a case and asked for it to be escalated to the backline team?

I have had a case open for several days without a solution. I will ask for escalation. Thanks

We are facing this same issue, are there any workarounds?

Not yet

The case was escalated and I received verbal confirmation that Symantec was able to duplicate the problem and it would be fixed in the next release.

This issue has been resolved in SEP Version 12.1.5.

confirmed?