Jump to content

Lost & Found still showing clients with Agent installed and Endpoint installed


MrWrighty
 Share

Recommended Posts

We run both Protect Cloud and Protect On-Prem for various clients, but in both environments all computers are shown in both the Lost & Found static group and also the relevant dynamic client group such as Windows Server and Windows Desktops. No matter what I do I cannot get the clients to disappear from Lost & Found. In both groups the clients show as FQDN for the local network such as pcname.mylocaldomain.com. All clients show the Group Name as Lost & Found even in the Dynamic Group they belong too. I have templates that move clients in to dynamic groups depending on whether the Agent is installed to not. But the Static group Lost & Found always shows all of the client computers. What am I missing?

Link to comment
Share on other sites

  • ESET Staff

Hello @MrWrighty can you please share the screenshot of your "computers" screen.

My understanding is, that the only thing you have there is group ALL, then Lost and Found, and various "Dynamic Groups" underneath. Is this correct? Please note, that Dynamic Groups are "dynamically filled in" and are located under the group "all" (at least the predefined ones). 

If you want to move the clients "permanently" out of "lost and found" you have to create some "static groups" and manually move the clients to the corresponding group. 

Also, computer can´t be moved to a dynamic group if it does not have agent, as the "agent" is required to evaluate the dynamic group membership (evaluation happens on the computer, by the agent). So such dynamic group will not work. 

Edited by MichalJ
Link to comment
Share on other sites

Hi @MichalJ All computers have the Agent and Endpoint Antivirus installed and are updating accordingly and communicating with ESET Protect. All computers including servers are shown in Lost & Found as well as the respective Dynamic Groups i.e. Windows Desktops and Windows Servers. 

You will see from the screen shots that the Static group Lost & Found shown all the clients as does the Dynamic Windows Group. This is taken from an On-Prem ESET Protect console.

Below is Lost & Found

Screenshot 2022-01-24 at 15.43.26.png

Below is Windows Computers

Screenshot 2022-01-24 at 15.45.51.png

Edited by MrWrighty
Link to comment
Share on other sites

  • ESET Staff

Hello @MrWrighty, thank you. Basically, as explained before, this is a completely correct / expected behavior. 

"Windows computers" is a "dynamic group / filter" with a condition "OS = Windows", applied on a group "All".

"Lost and found" is a subgroup of "All" meaning all computers from Lost and found are also members of group all. And subsequently, as the conditions are met, also of the respective Dynamic Group. By default, when a new machine is installed / connected, it is always a member of "Lost and found". Purpose of this group is to identify newly enrolled / not properly attributed devices. 

If you want to move them elsewhere, you can crate custom "static groups" and move (drag / drop) the machines there. 

Link to comment
Share on other sites

1 minute ago, MichalJ said:

Hello @MrWrighty, thank you. Basically, as explained before, this is a completely correct / expected behavior. 

"Windows computers" is a "dynamic group / filter" with a condition "OS = Windows", applied on a group "All".

"Lost and found" is a subgroup of "All" meaning all computers from Lost and found are also members of group all. And subsequently, as the conditions are met, also of the respective Dynamic Group. By default, when a new machine is installed / connected, it is always a member of "Lost and found". Purpose of this group is to identify newly enrolled / not properly attributed devices. 

If you want to move them elsewhere, you can crate custom "static groups" and move (drag / drop) the machines there. 

OK Many Thanks

I assumed that the Lost & Found was a group that only contained new computers before they had the agent installed etc. 

Link to comment
Share on other sites

  • ESET Staff

Computers can appear in "lost and found" either by: 

  • Installing the agent, and "connecting" for the first time
  • Synchronizing against active directory (cloud/on premises) / manually adding a computer (valid to on premises version only). 

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...