I need a solution
The title of this might be confusing so will explain some more! We use unmanaged detectors on SEP 12, one on each subnet. My query is once SEPM has recieved a report of a "unmanaged" device does it keep that info on the notifications even when the device is no longer connected to the network?
Our problem is we recieve a list of unmanaged devices and when it comes to pinging these 50% don't respond anymore or are false positives as the device that may have been on that IP has now changed as we use DHCP so the MAC that SEPM reports as unmanaged is no longer assigned to that IP. Is there a way of:
a) Checking the timestamp that SEPM was made aware of these.
b) Clearing out old information from the database (stuff that is no longer live)