cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
MSarge
Level 7
Report Inappropriate Content
Message 1 of 6

Historical data for deleted system

Jump to solution

Hello there. We recently had a laptop stolen, and it was deleted out of AD (which then synced to EPO and the object was removed). Our security guy would, however, like verification that the laptop was encrypted with Drive Encryption at the time it was stolen. Since the object was deleted, however, I can't see that data. Is there a report or some way to pull up information on the status of the laptop at it's last communication?

1 Solution

Accepted Solutions
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Historical data for deleted system

Jump to solution

Do not restore briefly unless you have made no changes to extensions and that all epo and agent handler server service and eventparser are turned off.  You don't want to mess things up.  Better option is to restore it as a different name temporarily.  Then, in epo current instance, create a query to get the info you want, filtering on a system name that would have encryption status enabled.  Save the query, then highlight it, view query sql and copy the syntax.  You can then run that query against the restored database, substituting the filtered system name with the one you actually are looking for data on.  That should get you the status that you want.

Doing it that way doesn't affect your existing production environment.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

5 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Historical data for deleted system

Jump to solution

Not really if the system has been deleted.  You can, however, restore a backup copy of the database to some other location and get info from that for before the system was removed.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

MSarge
Level 7
Report Inappropriate Content
Message 3 of 6

Re: Historical data for deleted system

Jump to solution

Thanks. I assume that would also involve spinning up another installation of the EPO server to point at the backup database? Or would I be able to briefly point the existing server at that backup database without messing everything up?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Historical data for deleted system

Jump to solution

Do not restore briefly unless you have made no changes to extensions and that all epo and agent handler server service and eventparser are turned off.  You don't want to mess things up.  Better option is to restore it as a different name temporarily.  Then, in epo current instance, create a query to get the info you want, filtering on a system name that would have encryption status enabled.  Save the query, then highlight it, view query sql and copy the syntax.  You can then run that query against the restored database, substituting the filtered system name with the one you actually are looking for data on.  That should get you the status that you want.

Doing it that way doesn't affect your existing production environment.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

MSarge
Level 7
Report Inappropriate Content
Message 5 of 6

Re: Historical data for deleted system

Jump to solution

Oh, I see, directly query the database. That makes more sense. Thanks again.

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Historical data for deleted system

Jump to solution

Anytime!  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community