none
HOW TO DELETE A MACHINE (Client) IN WINDOWS DEFENDER ATP

    Question

  • How can i delete a Machine in Windows Defender ATP from the Machines View ?

    e.g. demo-abby-lap ?

    Thanks

    Thursday, June 23, 2016 6:59 AM

Answers

  • Machine will continue to be tracked by WDATP as long as the sensor is on-boarded to your organization, regardless of its domain join/workgroup status. This in order to accommodate for MDM (mobile workforce, BYOD) scenarios as well.

    If you wish to turn off tracking for a given machine, you can off-board it from the service (see endpoint management page accessible from the left-side navigation menu).

    Off-boarding a machine will stop it from reporting new cyber data to the portal but will not delete its historical record.


    Monday, July 4, 2016 12:19 PM
  • Thank you very much, I found the solution;

    I used IE11 and there was no Off-boarding showing in IE11; Now i tried Mozilla Firefox and Off-boarding is accessible.

    Thanks for your support.


    • Edited by Mr.Orange Tuesday, July 5, 2016 5:48 PM
    • Marked as answer by Mr.Orange Tuesday, July 5, 2016 5:49 PM
    Tuesday, July 5, 2016 2:19 PM

All replies

  • Resolving all the active alerts on the machine will be removed it from the high risk machines view on the dashboard.

    Thursday, June 23, 2016 3:01 PM
  • Thanks for the info, i already Resolved all the active alerts, but i want to completely remove the Machine from Machines View.

    Thank you for your support.

    Friday, June 24, 2016 7:47 AM
  • Who can help, how can i delete a Machine from Windows Defender ATP = Machines View ?

    • Edited by Mr.Orange Monday, June 27, 2016 6:55 AM
    Monday, June 27, 2016 6:51 AM
  • There is no action enabling to delete records of a machine from the system through the portal. All machines records are kept historically for up to 6 months.

    If you wish to remove all data by deleting the account, contact us directly via the email address through which you got the invite to join.

    Friday, July 1, 2016 12:03 PM
  • I don't want to delete records of a machine, I want to know how i can delete a Machine from the Windows Security Center (Windows Defender ATP) ==> Machines View !!! ???
    Saturday, July 2, 2016 12:07 PM
  • Machines view page shows all machines in the organization regardless of their risk level and therefore machines cannot be deleted from it.

    You can apply filters on it to avoid seeing certain machines: like filter by last seen or detection categories. Once you change the filter, your new preferences will be kept.

    Sunday, July 3, 2016 11:13 AM
  • Ok but what happens when i want do remove a machine from my domain or workgroup ?
    Monday, July 4, 2016 10:26 AM
  • Machine will continue to be tracked by WDATP as long as the sensor is on-boarded to your organization, regardless of its domain join/workgroup status. This in order to accommodate for MDM (mobile workforce, BYOD) scenarios as well.

    If you wish to turn off tracking for a given machine, you can off-board it from the service (see endpoint management page accessible from the left-side navigation menu).

    Off-boarding a machine will stop it from reporting new cyber data to the portal but will not delete its historical record.


    Monday, July 4, 2016 12:19 PM
  • Thank you very much, I found the solution;

    I used IE11 and there was no Off-boarding showing in IE11; Now i tried Mozilla Firefox and Off-boarding is accessible.

    Thanks for your support.


    • Edited by Mr.Orange Tuesday, July 5, 2016 5:48 PM
    • Marked as answer by Mr.Orange Tuesday, July 5, 2016 5:49 PM
    Tuesday, July 5, 2016 2:19 PM
  • How can you Off-board a machine when you don't have the machine anymore in your environment.
    Thursday, July 7, 2016 7:41 AM
  • I have the same question. After deploying ATP my test machine got caught in a restart/repair loop so I had to revert to a restore point. Now ATP is no longer active on the computer but it's still showing up in the ATP console. I've also tried running the offboarding script but the compute still shows up in ATP.
    Friday, March 9, 2018 9:55 PM
  • Unfortunately this does not cover situations where computers are lost, stolen, damaged etc.  I would like to remove the computer as it is no longer part of the organisation.  How is this done ? over time I will have many machines that were not properly offboarded cluttering my machine list and no way to make comments about the status of the machine (apart from tagging as Obsolete).

    This is something that needs to be resolved.

    Tuesday, June 26, 2018 12:08 AM
  • MY endpoint was formated and i want to take it off the list of on board machines. 

    having the same problem

    thank you in advanced

    Monday, July 30, 2018 3:18 PM
  • I am having the same issue with regards to removing workstations. I think the answer is to just wait six months for the system to drop off. Can anyone verify systems drop off after six months of no activity?
    Wednesday, September 19, 2018 5:44 PM
  • Machines that were not offboarded and are not in use anymore for whatever reason, disappear after your data retention passes. This is 30 to 180 days depending on your setting.
    Saturday, April 6, 2019 5:12 PM