Help with possible reattached Computers

[Justus Folding 0]

Hi, I'm new to the forums.

I work for an IT company based in Des Moines, Iowa called Iowa PC Services. We have recommended ESET Endpoint Antivirus for any of our customers who want a good antivirus. We have a partnership with ESET and have over 1000 computers in the Des Moines area that have ESET on them. We use ESET Protect to monitor the state of the computers, that means along side installing EEA we also install the ESET Agent. We are having an issue where old computers that we have removed from our system using "remove > stop managing > remove > remove device from database > deactivate installed products"  have showed back up in our system. 

They typically appear as a "security risk", with "not updated modules", and "product not activated". I've tried removing them again and again, but they just show up again. 

Is there any way to keep this from happening?

Attached is a picture of what they appear as.

[MartinK 383]

Not sure I understood it correctly, but from provided steps I think that crucial part missing is that in order to actually stop managing of devices, uninstallation of ESET Management Agent is required. This can be done manually or via "Stop managing" client task (more details in documentation). Once task is executed, device will stop connecting, and that is a moment when it can be removed as mentioned previously.

Also note that result of "Stop managing" task won't be finished, so there is no need to wait for that, but I would recommend to verify at least last connection time to be sure, otherwise device might re-appear once it connects again.

[itman 1,746]

Review this: https://help.eset.com/protect_admin/80/en-US/remove_computer_from_management.html to ensure remove steps are performed in the correct sequence.

[MichalJ 434]

Hello @Justus Folding Basically, as martinK stated what you missed is the step of "agent removal". The steps you did, deleted the database entry, and triggered deactivation of the endpoints. However, the computer still has the agent, and agent will connect back to the computer, most likely to the lost and found group. Also, it will report functionality problem of "not activated", meaning that both agent / Endpoint remained on the machine however without a license. 

The best thing would be to do the following steps: 

1. Uninstall Endpoint via "software uninstall" task / or from client details 
2. Trigger the "stop managing task" 
3. After a while, when the machine stops connecting, remove the entry 

Regards,

Michal