Forum Discussion
Solved
Remove devices from MDATP portal
We have a couple of devices that are showing in MDATP which we would like to get rid of, however we are not in a position to run any scripts... One was registered in InTune by mistake and has been u...
neilcarden Sorry for the confusion, it's poorly labeled in ATP. Here is a screenshot of what it should look like before you run the query (it looks like you're entering the comment in the bottom "Response body" when it should be the top unlabeled input box):
Thank you,
Kate
neilcarden The only option is to get the offboarding script and run that on the computer you want to offboard. I had this situation when I was evaluating MDATP, which was on a different portal and lost access to the portal.
Regarding existing device, if you haven't off boarded it using the script, you will see two machines but after some time the old machine will be shown as inactive and then as per the retention period you set on the portal, the device will be removed. What I usually do in this case is tag the old computer and this way I can easily identify the old machine name.
Ah yes OK, makes sense, the old device is showing as inactive.
So apart from running the offboarding script on the other device that is now unregistered, that will never drop off?
Neil
neilcarden If the machine is not communicating the MDATP portal, after few days it will be set as inactive and based on the retention you set, will then be removed.
I just created a video where I explained this and the retention period, you can check there as well, but it talks more about the new endpoint manager portal. https://www.youtube.com/watch?v=aHhjQKtbS98
- The ability to manually remove machines would be a welcomed feature. I’m in the process of rolling WDATP out via Azure Security Center and have multiple duplicate machine entries as a result of some reconfiguration work that we’re doing on the servers.
Would be handy to be able to manually delete the orphaned entries.
