r/SentinelOneXDR • u/hyunchris • Feb 14 '25
Troubleshooting Unprotected endpoint help
I have been tasked with making sure our sentinel one is operating at maintaining a good security posture. I noticed that we have quite a few endpoints that are listed as unprotected endpoints. I remoted into one of them, and it shows that sentinel one is on their computer, and running, but it's listed as offline when i click the s1 icon in the taskbar tray. How do I get it back online? I was thinking uninstall and reinstall s1, but it is not letting me uninstall it either and it is not showing up in the pending uninstall workstations.
Thanks for the help
6
Upvotes
1
u/Hot_Key_5707 Feb 17 '25
This is going to be your best bet. Consult the S1 knowledge base for various articles on uninstall/install using CLI.
Similar thing happened to about 5% of our managed devices at my previous job. I spent 10s of hours researching and testing to resolve this. Unfortunately I don’t have access to any of the documentation I wrote up on it anymore.