As part of SIEM maintenance we remove retired data sources from the SIEM. The problem is due to volume we've relied upon Parent-Client groups to manage data sources. As I retire data sources I am unable to disable clients so WMI calls are not performed to the retired host. Is there a way to "break" the parent client. I cannot delete the client in some cases due to regulatory requirements.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.