SES hybrid - clients number at home page keeps changing after clients reinstallation

Products

• Endpoint Security Complete

Issue/Introduction

You have a hybrid environment and migrated some of the SEPM clients to cloud by reinstalling clients.

You have noticed that clients started to disappear from the SES console after some time just to reappear shortly after.

Environment

Hybrid - SEPM enrolled to SES.

As a cloud migration method, some of the SEPM related endpoints clients have been reinstalled to be managed by cloud SES.

The missing servers were synched in the SES cloud under your hybrid SEPM group in the cloud console. 

Cause

Because the missing servers were already synched in the cloud under your SEPM group, the following flow executed:

1. Old SEPM client was uninstalled during reinstallation but device record still exists on the Cloud and SEPM.
2. New client installed, and during device enrollment it used the same device record on cloud (because machine-id and other major device attributes are same). At this point SEPM has no idea that device was moved to cloud and considers it to be offline.
3. After some times device will be automatically purged from the SEPM because it stopped reporting and the configured purge clean-up kicked in.
4. Because the same device record is used and SEPM was not aware that device was re-enrolled to the cloud, SEPM requested cloud to delete synched copy of the device as well, making it disappear from both SEPM and cloud.

Resolution

No need for a manual action. Described behavior is considered to be per design and devices will re-register with the next heartbeat after getting purged.