Dark Devices report

The Dark Devices report includes information about devices with an active Secure Endpoint Agent that have not connected to the Absolute Monitoring Center for 30 days, or have never connected. If desired, you can edit the report's filters to change the time range and the units (for example, hours instead of days).

On the Reports page, you can access this report from Absolute view or the Device category. You can also access it from the Dark Devices widget on the Dashboard.

The Dark Devices report applies to all supported devices.

By default, the following filters are used to generate this report:

Agent status is Active and

Last connected The date and time when a device's component manager last connected to the Absolute Monitoring Center. For online devices, the component manager connects every 15 minutes. Also see component manager (CTES). not within last 30 days or

Last connected is empty or

Last core agent connection The date and time when the device's core agent last connected to the Absolute Monitoring Center. For online devices, the core agent connects once every 24.5 hours. Also see core agent (rpcnet). not within last 30 days or

Last core agent connection is empty

The Dark Devices report includes a default collection of device information organized in the following columns:

Column

Description

Device name

Device name, which includes the device's device name The name assigned to the device in the operating system. For Chromebooks, device name is not applicable and therefore shows as "Chrome" in the Secure Endpoint Console. and serial number The identification number assigned to the device by the device manufacturer. For Windows devices, this value may correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.

To view the device's Device Details page, click the linked device name.

Last connected

Date and time when the device's component manager The component manager (also known as CTES) is installed on top of the core agent and manages the agent components responsible for initiating device actions and collecting device data. Most agent components are controlled by policies, such as the Hardware and Installed Applications policies. The component manager typically connects to the Absolute Monitoring Center every 15 minutes, at a minumum, to send device data and receive instructions. last connected to the Absolute Monitoring Center.
Last core agent connection Date and time when the device's core agent The core agent (also known as rpcnet) is a small software client that resides in devices that are managed in the Secure Endpoint Console. After the core agent is initially installed on a new device, it is activated with its first connection to the Absolute Monitoring Center and the device is enrolled in Absolute. The core agent then makes scheduled connections every 24.5 hours. last connected to the Absolute Monitoring Center.

Username

The username of the user who was logged in to the device when an agent connection occurred. If no user was logged in during the most recent agent connection, the last detected username shows.

Make

The manufacturer of the device.

Model

The model of the device.

Device Freeze > Status

The status of the freeze request on the device.

Possible values are:

  • Freeze Requested
  • Freeze Pending
  • Scheduled Freeze Pending
  • Frozen
  • Frozen by Policy
  • Unfreeze Requested

Encryption > Status

The summarized encryption status of the device.

  • Encrypted: a full-disk encryption product is installed on the device and the system drive is fully encrypted
  • Not Encrypted: a full-disk encryption product is installed on the device, but the system drive is not encrypted
  • Not Detected: a full-disk encryption product is not detected on the device
  • No Data: encryption status is not yet available (waiting for the device to check in to the Absolute Monitoring Center)

  • Additional statuses that apply only to Windows devices:

    • Used Space Encrypted: all disk space that contains data is encrypted by BitLocker Drive Encryption, but free space is not encrypted

      This status indicates that the Used Disk Space Only encryption option is enabled in BitLocker. For more information about this option, see Microsoft BitLocker Drive Encryption documentation.

    • Suspended: BitLocker Drive Encryption is suspended
    • Encryption In Progress: the system drive is in the process of being encrypted by BitLocker Drive Encryption
    • Decryption in Progress: the system drive is in the process of being decrypted by BitLocker Drive Encryption

Anti-Malware > Product name

The anti-malware product that is detected on the device.

You can use most of the device information as search criteria to search for a device, or a group of devices. You can also include other device information in the report, such as custom fields, by adding more columns. To refresh the report's data, click in the page footer.

If No Data shows in a column, the information was not detected on the device.

By default, the report data is sorted by the Device Name column, in ascending order. You can change the sort order by clicking a column heading.

Depending on the Absolute licenses associated with your account, and your user role, you may be able to perform some or all of the following tasks on the Dark Devices report:

Depending on the Absolute licenses associated with your account, and your user role, you may be able to perform some or all of the following tasks on the devices in this report: