Forum Discussion
ATP - Duplicate Entries in Machines List
- Mar 01, 2019
Hi Jason,
welcome! Thanks for reaching out.
o, the offboard script will offboard the machine, but the entry in the tenant remains. That's actual on purpose and a good thing, because even if the machine doesn't exist anymore - in case a threat hit your network via that machine, you still wanna be able to go back in time to that machine to understand the full story.
The old machines will disappear after the days you picked for your data retention.
Hi Jason,
welcome! Thanks for reaching out.
o, the offboard script will offboard the machine, but the entry in the tenant remains. That's actual on purpose and a good thing, because even if the machine doesn't exist anymore - in case a threat hit your network via that machine, you still wanna be able to go back in time to that machine to understand the full story.
The old machines will disappear after the days you picked for your data retention.
- JasonMoranMar 01, 2019Copper Contributor
Thank you for the information. Very Helpful
- Joseph WallisAug 15, 2019Copper Contributor
HeikeRitterI have this problem too except I've not offboarded any machine nor do I want to. I'm seeing duplicates for a given machine when I upgrade it from one build of Windows 10 to another. This is happened twice now and I'm worried what happens when I upgrade them again.....3 entries in ATP? Not acceptable!
- David CaddickAug 19, 2019Iron Contributor
Hi Joseph Wallis I'd also like to see some way of tidying things up...
- Joseph WallisAug 20, 2019Copper Contributor
David CaddickI just want it to work right. I dont trust a product that has poor data management.
- David CaddickAug 20, 2019Iron Contributor
HeikeRitter We appear to have somehow got a number of duplicate entries due to someone not following the correct procedure and now have a customer complaining and point out that they can't trust either Defender ATP or InTune as to which is telling the truth...
While I understand your point about not wanting the devices to be removed from a security/fprensics point of view - how can we accurately set a baseline when all the machines are correct and accounted for when this happens? can we raise a support ticket with MS and have someone in support behind the scenes sort this out on the customers behalf?- Joseph WallisAug 21, 2019Copper Contributor
duplicate entries for the same machine that occur just because it upgraded to a new build of 10 is not acceptable. Other AV solutions have figured this out.