Releasing product licenses from devices

This topic applies to version 1 of the Licensing feature.

Devices with an installed and activated Secure Endpoint Agent consume an Absolute product license. From time to time, you may find that your account is using more licenses than expected, or the agent is installed on more devices than you have licenses for. This situation can occur when the Secure Endpoint Agent is:

installed on new devices without removing the agent from older devices that you've retired.
inadvertently installed on some devices using a script or disk image.

By identifying those devices that are consuming a license that shouldn't be, and then unenrolling each device to remove its agent, you can release licenses so they can be used by other devices. You'll also want to clean up your licenses before they expire so you know exactly how many licenses to renew, and how many additional licenses you need.

You can use the License Consumption widget on the Dashboard to view the current status of your Absolute product licenses. The widget shows the numbers of consumed licenses, available licenses, and licenses that are expiring within the next 30 days. It also shows the number of devices in the Unlicensed Policy Group. These devices are unlicensed because they were enrolled in Absolute when no licenses were available, or because their license expired. When there are devices in the Unlicensed Policy Group, a notification banner shows each time you log in to the Secure Endpoint Console.

Finding devices to unenroll

By default, the All Devices page in the Devices area shows all devices with an installed and activated Secure Endpoint Agent, meaning they are consuming an Absolute product license. To uninstall the agent from a device and release its license, unenroll the device from your account. To find devices to unenroll, you can add one or more filters to the All Devices page.

The following are some examples of filtered searches that may help you identify devices to unenroll:

If you want to ...	Filter on ...	For example ...
Find devices with older activation dates A field and report column that shows the date and time that the device completed its first check-in to the Absolute Monitoring Center and the device's Secure Endpoint Agent was activated. that you want to retire	Activation date	You purchased a three-year license term and a device has an enrolled date that is older than the term you purchased, you can unenroll the device to free up its license. To find these devices, add the following filter to the All Devices page: Activation date not within last 3 years.
Replace older hardware with new machines	Model	You've acquired new hardware and you may want to retire some older models of your devices. Add a filter to search for specific device makes and models that you know have been retired.
Find devices on which the Secure Endpoint Agent shouldn't be installed	Model	Your devices are consuming more Absolute product licenses than expected and you suspect that the Secure Endpoint Agent was inadvertently installed via a disk image on some virtual machines that you didn't buy licenses for. To see if this is the case, add the following filters to the All Devices page: Model contains vm OR Parallels OR virtual OR Hyper-V.
Find devices that are no longer in use	Last connected	You want to search for devices that haven’t connected to the Absolute Monitoring Center in the past 6 months. To find these devices, you add the following filter to the All Devices page: Last connected not within last 6 months.
Find devices with an older version of the operating system to retire	OS version	You think there may be some Windows devices in your fleet that are running Window Vista and you want to replace them with Windows 10 devices. Find the Windows Vista devices by adding the following filter to the All Devices page: OS version contains Vista.
Find devices to retire based on a device naming convention	Device Name	Your device naming convention dictates that the device name assigned to all desktop machines are prepended with DSK-. Your organization decided that the Secure Endpoint Agent shouldn't be installed on these devices, so you add the following filter to the All Devices page to see if any of these devices are enrolled: Device name begins with DSK-.

Unenrolling devices

To find and unenroll devices:

Log in to the Secure Endpoint Console as a user with Perform permissions for Unenroll Device.
On the navigation bar, click Devices.

Notice that the Agent Status is Active filter shows in the page's filter area.
Find the devices that you want to unenroll by adding the appropriate filters.
For example:
To create a report that shows all HP Elitebook laptops (models 8560P or 8570P) with an installed and activated Secure Endpoint Agent, do the following:
1. Leave the Agent Status filter as is.
2. Add a filter by doing the following:
  1. Click and add the following filter: Model is HP ELITEBOOK 8560P.
  2. Click OR and add the following filter: Model is HP ELITEBOOK 8570P.
  3. Click Apply.
The results are updated to show active devices that match either the 8560P or 8570P model number.
[Optional] If you have purchased multiple base licenses A license associated with a core product offering, such as Absolute Resilience, Absolute Control, or Absolute Visibility. Base licenses include a suite of features that provide key capabilities in multiple areas., add the Policy Group column to the report to see which policy group each device belongs to and therefore, which base license it is consuming. You can also see if any devices are in the Unlicensed Policy Group.

You can also unenroll devices from the Devices page in a policy group.
To unenroll the devices, do one of the following:
- To submit a request from the filtered All Devices page:
  1. Select the check box next to each device you want to unenroll. To select all devices, select the check box next to the Identifier column header.
  2. Click Unenroll.
- To upload a file of device identifiers and submit a request:
  1. On the filtered All Devices page, click > Edit columns and remove all columns except the Identifier column.
    
    If you don't want to unenroll all of the devices shown on the filtered page, you'll need to delete the applicable Identifiers from the exported file after you download it.
  2. On the action toolbar, click Export and export the report in .csv format.
  3. On the quick access toolbar, click (Upload Bulk Device File).
  4. Click Select Device Action, select Unenroll Device, and then complete the steps to upload the report you downloaded.
Complete the steps to submit an Unenroll Device request.

The Unenroll Device request is submitted and a notification indicates that Unenroll has been requested.

The Agent status of each device is set to Disabled and a Device disabled event is logged to Events. For Chromebooks, Chromebook > Extension is also set to Disabled. Each device is unenrolled from your account on its next successful agent connection. When you view the Device Details page for the device, a status alert banner appears in the summary device information showing the date and time the Unenroll Device request was submitted.

If a device has an outstanding Freeze request or the device is Frozen, the Unenroll request automatically removes the Freeze request or Unfreezes the device. No Freeze events are published to Events as the device is no longer communicating with Absolute.

You can track the progress of the Unenroll request in Actions. If the Unenroll request fails to complete for any reason, such as the user not having permission for completing device actions on a selected device, the Action status is set to Failed and the reason is displayed in Failure reason. You can view unenroll events in Events.

If you unenroll a device in error, you can re-enroll it.

If there are devices in the Unlicensed Policy Group, unenrolling devices doesn't automatically move the unlicensed devices to the policy group with the newly available licenses. You'll need to use the Move Devices... action to move the devices from the Unlicensed Policy Group to another policy group.