Environment
Security Manager 6.x
Situation
When an Agent in uninstalled (not deleted) you can no longer view data in forensic queries from that agent. The following information is displayed:
Some of the report results have been filtered out because of your permission settings.
Some of the report results have been filtered out because of your permission settings.
Resolution
- Open the Security Manager Monitor Console.
- Launch the Agent Administrator.
- Select Agent Summary and then Agent Summary View.
- Inside the Agent Summary View:
- Place a check in show hidden computers.
- Find the uninstalled agent in the list.
- Find the hidden column and set the option to "No".
- Click Apply and Close.
- Place a check in Apply configuration changes now and click ok.
Cause
When an agent is uninstalled the hide flag is enabled on the agent. This flag effects the security permissions on the agent and also makes it's event data hidden from all views.
Additional Information
Formerly known as NETIQKB71536
The hidden agent setting also effects existing completed forensic queries. Existing completed forensic queries will be updated automatically with the changing of the hidden flag on each uninstalled agent.