×
×
×
×

Configure Inactive Computer Policy

Last Updated On: 05 Nov 2026|
18 minutes read |

This guide explains how to configure the Inactive Computer Policy in Endpoint Central to automatically notify, stage, or delete computers that stop contacting the Central Server.

The policy runs on a configurable daily schedule and evaluates every computer under your Scope of Management against three thresholds — notify, stage, and delete — in sequence. Each threshold is independently optional. Only the thresholds you enable are enforced.

Warning
Before you enable the delete threshold: deletion is irreversible from the console. The computer record is removed and the agent is uninstalled on the device's next server contact. Re-adding a deleted computer requires manually reinstalling the agent. Review your threshold values carefully before saving.
Note
This "reinstall required" behavior applies to any computer removed from Scope of Management, not only computers deleted by this policy — the same applies to a computer removed manually via Remove Computer(s). A computer can also disappear from Scope of Management for reasons unrelated to this policy, such as manual removal or deletion of its remote office.

When to Use This Policy

Configure this policy when:

  • Your environment includes computers that may go offline for extended periods — remote laptops, decommissioned VMs, retired hardware, or branch office machines with intermittent connectivity.
  • You want early warning before a machine silently disappears from your managed inventory.
  • You need automated cleanup of stale computer records without manual audits.
Note
This policy applies globally to all computers under Scope of Management. There is no per-group or per-OU scoping at this level.

Prerequisites

Before configuring the policy, confirm the following:

PrerequisiteHow to Verify
Endpoint Central Server is runningNavigate to the EC console login page — it should load without error.
Computers are enrolled under Scope of ManagementGo to Admin → Scope of Management → Computers and confirm devices are listed.
A valid notification email is availableRequired to receive alerts at each threshold stage. If the Mail Server Not Configured banner with a Configure Now link is displayed, it indicates that the mail server has not been configured in Endpoint Central. Configure the mail server to enable email notifications. For more information, see Configuring the Mail Server.

Understanding the Three Thresholds

The policy operates as a sequential pipeline. A computer moves through stages based on how long it has been silent.

StageWhat HappensReversible?
NotifyComputer flagged in Managed Computers view; email sent.Yes — no change to agent or management state.
StagedComputer moved to Staged Computers page; email sent.Yes — manually or automatically if it reconnects.
DeletedComputer record removed from console; agent uninstalls on next contact.No — agent must be reinstalled to re-add.
Warning
The delete threshold must be higher than the stage threshold, which must be higher than the notify threshold. The UI does not enforce this automatically — entering values out of order (e.g., delete = 10, notify = 15) will produce undefined behavior. Always verify: Notify < Stage < Delete.
Note
If a computer reconnects to the Central Server before it reaches a given threshold, no action for that threshold occurs — for example, a computer that reconnects before the delete threshold is reached is not notified, staged, or deleted.

Steps

1. Navigate to the Inactive Computer Policy page

In the Endpoint Central console, navigate to Agent → Inactive Computer Policy.

Configure inactive policy navigation

2. Enable the Notify threshold

  1. Check "Notify me if a computer has not contacted the Central Server in the past [N] Days".
  2. Enter the number of inactivity days (for example: 15). Set this based on the typical offline window acceptable in your environment.
Inactive policy notification
  • What this does: The computer remains fully managed. No agent action occurs. It appears flagged in the Managed Computers view and a notification email is sent to configured recipients.
  • What this does not do: It does not move the computer to Staged or affect the agent in any way.
Note
To view which computers are currently inactive right now, without waiting for the scheduled run, go to Agent → Computers → Filters and add a filter on Last Contact Time (operator "Before n Days", using the same day count as your threshold) or on Agent Live Status equal Down, then Save & Apply. This same filter technique can also be used to manually select and bulk-remove stale computers to free up licenses.

3. Enable the Stage threshold

  1. Check "Move computer(s) to the Staged Computers page and notify me if they haven't contacted the Central Server in the past [N] Days".
  2. Enter a value higher than your Notify threshold (for example: 30). This should reflect how long a machine can reasonably be unresponsive before it is treated as potentially lost.
Staged computers management
  • What this does: The computer is moved from the Managed Computers view to the Staged Computers page. A notification email is sent. The agent remains installed on the device.
  • What this does not do: It does not uninstall the agent. If the computer reconnects, whether it returns to management automatically or stays in Staged depends on the reconnect behavior setting in Step 4.
Note
While a computer is in the Staged Computers page, it does not consume a license, and it is excluded from Threat & Vulnerability Management and Patch Management scoring (including missing/critical patch counts) until it returns to Managed Computers.

4. Configure reconnect behavior for Staged computers

This checkbox controls what happens when a Staged computer re-establishes contact with the Central Server.

Checkbox StateBehavior on Reconnect
CheckedComputer is automatically moved back to Managed Computers. No administrator action required.
UncheckedComputer remains in Staged even after reconnecting. An administrator must manually click Enable Management to restore it.
  • Enable auto-restore for environments with frequently offline devices (roaming laptops, field machines) where reconnection is expected.
  • Leave unchecked in high-security environments where reconnecting unknown machines should require manual review before re-entering management.
Note
This setting only applies to Staged computers. It has no effect on deleted computers — deletion is permanent regardless of this setting.

5. Enable the Delete threshold

  1. Check "Delete and notify me if a computer has not contacted Central Server in [N] Days".
  2. Enter a value higher than your Stage threshold (for example: 90). Set this to the longest period your organization is willing to retain a stale record before permanent removal.
Delete if the device is inactive
  • What this does: The computer record is removed from the Endpoint Central console. A notification email is sent. The next time the device contacts the server, its agent is automatically uninstalled.
  • What this does not do: It does not immediately uninstall the agent — uninstall is triggered on the device's next server contact, not at the moment of deletion.
Warning
This action is irreversible. Once deleted, re-adding the computer requires reinstalling the agent manually. The auto-restore checkbox from Step 4 does not apply here.

6. Optionally remove the MDM enrollment profile

This option appears under the Delete threshold and is unchecked by default.

Check "Remove MDM Enrollment Profile" only if deleted computers should also have their MDM profile revoked.

Warning
Enabling this removes all MDM profile configurations, apps, and corporate data from the device if an MDM profile is installed. This affects the device itself, not just the console record. Confirm this is the intended outcome for your organization before enabling.
  • When to enable: Decommissioned devices being retired or reassigned outside the organization.
  • When to leave unchecked: Devices that may return to service and need their MDM config intact.

7. Set the schedule start time

  1. Under Schedule starts at, enter the time the policy check should run each day in 24-hour format (for example: 18:00).
  2. Select the correct time zone from the dropdown to align the schedule with your organization's working hours or off-peak window.
Note
The policy runs once per day at this time. Changes to thresholds or settings take effect at the next scheduled run, not immediately after saving.

8. Configure notification recipients

Under Notification Settings → Email address, confirm or update the email addresses that should receive alerts for all three threshold stages.

Verify that:

  • The email address is correct and active.
  • Your mail server or spam filter will not block automated notifications from the Endpoint Central server's sender address.

9. Save the policy

Click Save. A confirmation message will appear in the console indicating the policy has been saved successfully.

Note
The policy takes effect at the next scheduled run time. No action occurs immediately upon saving.

Verifying the Configuration

After the next scheduled run, confirm each of the following:

CheckWhere to Verify
Computers past the notify threshold are flaggedAdmin → Scope of Management → Computers (Managed Computers view)
Computers past the stage threshold are movedAdmin → Scope of Management → Staged Computers
Email notifications are being receivedInbox of configured recipients; check spam/junk if absent.
Computers past the delete threshold are removedConfirm they no longer appear in Scope of Management.
Deleted computers' agents are uninstallingVerify on the device on its next network contact.
Note
The policy runs on a daily schedule. If you've just saved the configuration, wait until after the next scheduled run time before concluding it is not working.

Troubleshooting

Computers not appearing as inactive despite exceeding the threshold

Cause: The scheduled run has not yet occurred since the policy was saved, or the computer's last contact timestamp was recently refreshed.

Fix:

  • Check the Schedule starts at time and confirm whether the daily run has occurred since you saved the policy.
  • Navigate to Scope of Management → Computers and check the Last Contact timestamp for the affected computer.

No email notifications received

Cause: Notification email address is missing, incorrect, or filtered by the mail server.

Fix:

  • Confirm the address under Notification Settings → Email address.
  • Check recipient spam/junk folders.
  • Verify that your mail server is not blocking automated messages from the Endpoint Central server's sender address.
  • If a "Mail Server Not Configured" banner is shown above the policy panel, no notification emails will be sent at all until a mail server is configured; click Configure Now on that banner, or see Configuring the Mail Server.

Staged computer not returning to management after reconnecting

Cause: The "Automatically add computer(s) back to management" checkbox was not enabled at the time the computer reconnected.

Fix:

  • Enable the auto-restore checkbox for future occurrences.
  • For the current computer: navigate to Staged Computers, select the device, and manually click Enable Management.

Agent not uninstalled after computer deletion

Cause: The deleted computer has not yet re-contacted the Central Server. Agent uninstall is triggered on next contact, not at deletion time.

Fix:

  • Confirm the device is powered on and network-reachable.
  • If the device needs to rejoin management, reinstall the agent manually — it will not re-add itself automatically.