Endpoint Protection

 View Only

  • 1.  HOw does an Unmanaged detector work? Where to place them?

    Posted Aug 06, 2015 05:41 PM

    I need to understand where to place an unmanaged dector on our network.  My main question is will one unmanaged dector work for the entire network or do I have to use multiple dectors?  like I made my PC an unmanaged dector and it returned only PCs on the 10.224.164 subnet.  Do i have to place seperate dectors on each subnet?  like 1 on 10.224.164.##   and then another on 10.224.165.## and then another on 10.224.166.## and so forth?  Hopefully that was clear?



  • 2.  RE: HOw does an Unmanaged detector work? Where to place them?
    Best Answer

    Posted Aug 06, 2015 05:44 PM
    One per subnet, unfortunately. They work based on arp requests which then uploads that data to the SEPM and the SEPM sends the alerts if it can't find that IP with a SEP client. Anything without a SEP client is detected. That includes routers, switches, printers, etc. Many exclusions are needed.


  • 3.  RE: HOw does an Unmanaged detector work? Where to place them?

    Posted Aug 06, 2015 06:25 PM

    Just to add to Brian's comment, even (self-managed) SEP clients that are not reporting to the SEPM will be considered as unmanaged. This is because the SEPM with term all the IP address that are not associated to (managed) SEP clients (that are reporting to the SEPM) as unmanaged.