Under Home tab, total endpoint showing is incorrect information compare to computer status report.
From the database found that, NPVDI client count is high, indicating that they're properly marked.
Looked into AgentSweeping log and found the following:
2020-06-25 00:05:14.612 THREAD 52 FINE: check oldest failed replication time, finished, return: 1571369483164
2020-06-25 00:05:14.612 THREAD 52 FINE: AgentSweepingTask>> sweepAgents: oldestFailedReplicationTime (ms)=1571369483164
2020-06-25 00:05:14.612 THREAD 52 WARNING: AgentSweepingTask>> sweepAgents: Adjusted oldestUpdateTime and oldestUpdateTimeNPVDIClients (ms)=1571369483164 1571369483164
2020-06-25 00:05:14.626 THREAD 52 WARNING: AgentManager>> deleteOldAgents: Begin... oldestUpdateTime=1571369483164, oldestUpdateTimeNPVDIClients=1571369483164
2020-06-25 00:05:14.647 THREAD 52 FINE: update SEM_AGENT set USN=?, DELETED=? where DOMAIN_ID = CONVERT(CHAR(32),?) AND DELETED = 0 and ( (LAST_UPDATE_TIME < ?) or (IS_NPVDI_CLIENT = 1 and LAST_UPDATE_TIME < ?) )
Looked into restored SEPM environment and found that the last replication time for site XXXXX is 10/17/2019. 11:31PM The time stamp in log is evaluated to 1571369483.164 => 10/18/2019 @ 3:31am (UTC).
Customer has a replication site which they were not using but replication is still enabled.
SEPM: 14.2 (Replication)
Once the replication is corrected and started replication to each site. Endpoint status is showing correct data.