Endpoint Protection

Hi ,

I Pulled computer status report lastweek ( 19/12/2016) from SEPM and I have taken another report this week(26/12/2016) , I compared with lastweek report I found that 8 workstation are automatically removed from SEPM and 100 + computer are connected back to the SEPM server.

Here my queries is auto deleted computer is last communcation time ( status change ) 20 /12/2016 however I have configured the "delete the computer not communicating server is 14 days" 

I could see the computers on lastweek ( 19/12/2016) with last communication is 19 the dec and this week  report that client last communication is 20 th dec 2016 If the computer goes offine on 20 th dec 2016 SEPM should have the computer information next 14 days but it removed automatically less than the configurated time.

Any idea?

What is your exact SEPM version?

SEPM version : 12.1.RU6 MP6

Server : Windows server 2008 R2 enterprise

I have checked today few computers are back with latest communication . May I know the reason behind that.

They must've been offline and came back on.

If it offline it should be present my previous report right ? while i was search that computer in SEPM am getting " no computers found " messgae .. 

Anything after 14 days would be removed automatically so yes it should be showing up. Was it manually deleted by someone?

Was it manually deleted by someone?  

No .

Is there any logs we can check how the clients removed from SEPM ?

Set your log config to this to see deleted computers

Also, make sure when you run the report that online status is set to All

Hi ,

I could see the below information in that list .

server name :

Event type : log succeed

Event description :administrator logon succeed

Time stamp : 

Admin name :

Here there is no computer information and them log activity . I have attached the the screenshot here.