I had a situation when customer uninstalled agent and CCS on his windows device, but we didn’t get any notification nor audit log is generated by EM. User’s device just disappeared from our device list. Audit log exists only for device removal performed by admin, but not for this case. I would think that this is a critical action that admins should be aware of.
The above situation is relevant for windows devices. For macOS devices, I have a situation that device is showing agent and AV icons pale, as not active, but I can still see customer on my device list and info on device’s last activity. How can this be possible?
Could somebody explain what would happen if user uninstalls agent on other OSs, like linux, android or iOS? How would this action be represented in EM device list?