Removing clients from SEP Cloud

[Graham Hooley]

We recently moved from SEP SBE Cloud to SES Cloud, whilst testing we noticed that if we deleted a Windows device from the Portal, the device was added back to the Portal when it checked in; the behaviour we expected was that the device would have its license revoked and become unprotected as it did in the SEP SBE Portal. When this did not happen we raised a support ticket and the response we received was surprising; it seems it is not possible to remove a Windows device from the Portal, so if a device is lost or stolen and you remove it from the Portal the device will appear again once it's online if the third party accesses the device. The only way to remove the device is to uninstall the client first, which is not possible if the device is lost or stolen.
Apparently, it is by design that you cannot remove devices by deleting them from the Portal

Has anyone else noticed this behaviour and raised a ticket with support?

[John Owens]

Yes. This is by design. 

[David Varro]

I think these "lost" devices will count in license. What if these "lost" licences makes overdeployment? Can I revoke somehow these devices from license counter?

Thanks
David

[Graham Hooley]

Hi John,

If this is by design then please let me know the logic behind this design choice?

We currently have 1 device showing in our Portal that is unauthorised and we cannot remove the client from the device as we do not have access, our only option would be to remove the device from the Portal; currently, this is not possible as the device shows up again once online, how do we remedy this situation?

In the SEP SBE Portal, we would simply remove the device, the licence would be revoked and the client would inform the user of the device that it is no longer protected.

We see the inability to remove the device from the Portal, to be a serious flaw.

[John Owens]

Hello Graham,

Clients that do not check-in after 30 days will be purged and the license will be released.  Please keep in mind SEPC and SES are different products and will not have feature parity.  The goal with SES is to have feature parity with on-prem SEPM.

If you feel the need for the option I would suggest filling out a Feature Request.

Thanks,

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[Graham Hooley]

Hi John,

You seem to have missed my point, this is about removing clients from a device if it is lost or stolen; in these circumstances, the client could be checking-in, how do we prevent this from happening?

In my opinion, being able to remove a client via the portal should be a core function, not a feature that has to be requested.

[John Owens]

Hi Graham,

Understood. This is not a feature of the SES product and I am not aware of a feature like this on the roadmap. A feature request will be needed if you would like this feature to possibly be considered for SES.

Thanks,
John Owens

------------------------------
John Owens
Strategic Support Engineer | Symantec Enterprise Division (SED)
Symantec
United States
------------------------------

[Elias Santiago]

Hi, this is STUPID as a design!!!  If SES is expanding on SEPM features, WHY would you not enhance current features not abandon those features that SES is supposed to EXPAND? 

We currently have a similar issue with a client that wants to remove the agent from certain device groups, the feature SHOULD work as expected!  DELETE the endpoint from the console, not expect the endpoint to show up again because the endpoint agent is NOT instructed to be uninstalled.  That makes NO SENSE in a security product!!!  That must be why the client wants to abandon this product forever!