MrWrighty 6 Posted January 24, 2022 Share Posted January 24, 2022 We run both Protect Cloud and Protect On-Prem for various clients, but in both environments all computers are shown in both the Lost & Found static group and also the relevant dynamic client group such as Windows Server and Windows Desktops. No matter what I do I cannot get the clients to disappear from Lost & Found. In both groups the clients show as FQDN for the local network such as pcname.mylocaldomain.com. All clients show the Group Name as Lost & Found even in the Dynamic Group they belong too. I have templates that move clients in to dynamic groups depending on whether the Agent is installed to not. But the Static group Lost & Found always shows all of the client computers. What am I missing? Link to comment Share on other sites More sharing options...
MrWrighty 6 Posted January 24, 2022 Author Share Posted January 24, 2022 Further to the above we do not use AD sync. Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted January 24, 2022 ESET Staff Share Posted January 24, 2022 (edited) Hello @MrWrighty can you please share the screenshot of your "computers" screen. My understanding is, that the only thing you have there is group ALL, then Lost and Found, and various "Dynamic Groups" underneath. Is this correct? Please note, that Dynamic Groups are "dynamically filled in" and are located under the group "all" (at least the predefined ones). If you want to move the clients "permanently" out of "lost and found" you have to create some "static groups" and manually move the clients to the corresponding group. Also, computer can´t be moved to a dynamic group if it does not have agent, as the "agent" is required to evaluate the dynamic group membership (evaluation happens on the computer, by the agent). So such dynamic group will not work. Edited January 24, 2022 by MichalJ Link to comment Share on other sites More sharing options...
MrWrighty 6 Posted January 24, 2022 Author Share Posted January 24, 2022 (edited) Hi @MichalJ All computers have the Agent and Endpoint Antivirus installed and are updating accordingly and communicating with ESET Protect. All computers including servers are shown in Lost & Found as well as the respective Dynamic Groups i.e. Windows Desktops and Windows Servers. You will see from the screen shots that the Static group Lost & Found shown all the clients as does the Dynamic Windows Group. This is taken from an On-Prem ESET Protect console. Below is Lost & Found Below is Windows Computers Edited January 24, 2022 by MrWrighty Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted January 24, 2022 ESET Staff Share Posted January 24, 2022 Hello @MrWrighty, thank you. Basically, as explained before, this is a completely correct / expected behavior. "Windows computers" is a "dynamic group / filter" with a condition "OS = Windows", applied on a group "All". "Lost and found" is a subgroup of "All" meaning all computers from Lost and found are also members of group all. And subsequently, as the conditions are met, also of the respective Dynamic Group. By default, when a new machine is installed / connected, it is always a member of "Lost and found". Purpose of this group is to identify newly enrolled / not properly attributed devices. If you want to move them elsewhere, you can crate custom "static groups" and move (drag / drop) the machines there. Link to comment Share on other sites More sharing options...
MrWrighty 6 Posted January 24, 2022 Author Share Posted January 24, 2022 1 minute ago, MichalJ said: Hello @MrWrighty, thank you. Basically, as explained before, this is a completely correct / expected behavior. "Windows computers" is a "dynamic group / filter" with a condition "OS = Windows", applied on a group "All". "Lost and found" is a subgroup of "All" meaning all computers from Lost and found are also members of group all. And subsequently, as the conditions are met, also of the respective Dynamic Group. By default, when a new machine is installed / connected, it is always a member of "Lost and found". Purpose of this group is to identify newly enrolled / not properly attributed devices. If you want to move them elsewhere, you can crate custom "static groups" and move (drag / drop) the machines there. OK Many Thanks I assumed that the Lost & Found was a group that only contained new computers before they had the agent installed etc. Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted January 24, 2022 ESET Staff Share Posted January 24, 2022 Computers can appear in "lost and found" either by: Installing the agent, and "connecting" for the first time Synchronizing against active directory (cloud/on premises) / manually adding a computer (valid to on premises version only). Link to comment Share on other sites More sharing options...
Recommended Posts