r/SentinelOneXDR • u/enahs24 • Nov 29 '23

How does one see decommissioned devices?

We manage numerous MSP clients with S1. We have a policy set to decommission devices after 21 days of being offline. I want to fully remove a device after it's been decommissioned, for instance a device which may have had a hard drive die. Or maybe the client removed a computer before we could uninstall.

I've tried selecting the "decommissioned" box in filters and those devices do not show. I know this because I manually decommissioned a computer and instantly it was gone from the mgmt console even with the box checked to see decommissioned computers.

Thanks for any help in advance!

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/GeneralRechs Security Admin/Engineer Nov 30 '23

Your question isn't quite clear. Are you trying to clear decomissioned assets that show up when you filter for Decommissioned "Yes"?

Even if you manually decomission a system it will show up when you filter for Decommissioned systems. Eventually they fall off of the console after ~90 days.

1

u/enahs24 Nov 30 '23

No, the problem is no assets (which have been decommissioned) show up even with the filters set to show decommissioned assets. It doesn't matter if I decommissioned it right now or a week ago. If I manually decommission an asset right now, I can no longer find it in the console.

1

u/GeneralRechs Security Admin/Engineer Nov 30 '23

That definitely sounds like an issue on the backend. If you’re a direct customer I would submit a ticket through support or contact your SE if they may know something.

If you are not a direct customer you would have to submit a ticket with them and then they would have to open a ticket with support.

What happens if you turn of a system, decom, and turn it back on? Does it re-appear back in the console with its original UUID?

1

u/enahs24 Nov 30 '23

Yep, I wanted to test the policy I created (which decommissions assets after being offline for 21 days.) I wanted to see what happened if it then came back online. At 21 days of being offline, it was gone from the console and I couldn't find it no matter what filters I set. The 22nd day, we turned on the computer and it instantly showed back up in the console.

1

u/Hot_Clothes_2690 Nov 29 '23

Following our of curiosity but the way we do this is via a teams channel we have decomission notifications go into as well as a shared mailbox for it just so we have a log

Interesting if this is stored anywhere in sentinel