After creating controller connections from the Symantec Endpoint Detection and Response (SEDR) on-premise console to one or more Symantec Endpoint Protection Managers (SEPMs), the Enrollment Statistics of SEDR on-prem console shows all or some SEP clients as Authentication Pending. In some instances, the clients may appear to register, but do not appear to send Data Recorder events. This may also be observed as a lack of events arriving to downstream log databases, such as splunk or ICDx.
SEP clients remain in an Authentication Pending state due to one of the following circumstances:
*Enabling additional columns on the Entities tab of the Search page within SEDR: