As part of SIEM maintenance we remove retired data sources from the SIEM. The problem is due to volume we've relied upon Parent-Client groups to manage data sources. As I retire data sources I am unable to disable clients so WMI calls are not performed to the retired host. Is there a way to "break" the parent client. I cannot delete the client in some cases due to regulatory requirements.
oops, looked right past the enable checkbox in the client list properties.
By de-Selecting the "enabled" checkbox will disable the client data source.