ATP 3.0 can take longer than expected to Rejoin clients when they are in Push mode

Products

• Advanced Threat Protection Platform

Issue/Introduction

You Isolated a client from the ATP 3.0 web interface, but it takes 20 minutes or more for the Rejoin command to complete.
 

Resolution

When you Rejoin an Endpoint Protection client, the ATP still relies on the client's heartbeat with the SEPM if it is in Push mode, even with EDR2 enrolled clients. If the SEP client has any network latency or connectivity issues, it can take an extended time for the client to Rejoin.