After creating a SEPM Controller connection to one or more Symantec Endpoint Protection Managers (SEPMs) in the Endpoint Detection and Response (EDR) appliance console, the Enrollment Statistics for all or some SEP clients is Authentication Pending. In some instances, the clients appear to be registered, but do not appear to send endpoint activity recorder events to Symantec EDR or to log databases (such as Splunk, QRADAR, or ICDx).
SEP clients remain in an Authentication Pending state due to one of the following circumstances:
Note - The definition and engine version can vary.
The Endpoints once Enrolled to EDR may get re-Enrolled in certain conditions such as,