I have a computer that belonged to the domain that had two viruses.
The computer was removed from the domain and we can't access it now.
Since SEP 12 we can't manually remove the Still Infected warnings.
Any solution?
This can't be done in SEP 12.1 manually any more. it happens automatically now. Run a full scan and ensure it's clean and SEPM 12.1 will update itself automatically.
See here:
Cannot Delete the "Still Infected" Value From the Symantec Endpoint Protection Manager 12.1 Console
You can scan that system to clean the still infected.
Manually it not be removed in SEPM 12.1
http://www.symantec.com/business/support/index?page=content&id=TECH165846
it will be cleared when the client sends the fresh logs again.
Seems like you may need to join them to again or make it to upload clean logs to SEPM.
if its showing infection as an USB drive, put any other USB and run the full scan.
The machine is no longer in the domain...
Do I need to rejoin the domain?
This doesn't make much sense... What if the machine crashes and we can't rejoin anymore?!
No, this is totally independent of domain. SEP doesn't care about that. It just needs to be able to report in to the SEPM so the SEPM knows it's clean.
But if for any reason the machine breaks and I can't turn it on anymore?
There is no solution for this?
You can connect the system with network and then run the full scan.
Manually delete from the SEPM if it will never connect again.