Inspect agents and recover device credentials
Find an agent, inspect capability and delivery reports, recover a device, revoke compromised credentials, or erase a retired endpoint.
Before you start
- An enrolled endpoint in the selected organization.
- Administrator privileges and a recent MFA check for protected recovery actions.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Find the device in a fresh snapshot
Open Admin → Agent fleet and choose Refresh agents. Enter the hostname or agent ID, select Status checkboxes, and use the Agent platform selector for macOS, Windows, Linux, or Other / Unknown. Read Loaded … of … and the snapshot time. These filters apply to the loaded snapshot; use All endpoints and fleet filters for the full endpoint view.
Read health and capability evidence
Compare Version, Status, Last heartbeat, Activity, Crash sensor, Outbox, and Modules. Capability badges describe what the agent reports it supports; they are separate from whether your policy enables collection. An outbox warning describes delivery backlog and deserves investigation even when the last connection status says online. Use View to open the endpoint’s detailed history and telemetry.
Issue a recovery token for the existing device
On the correct row, choose Recovery token, confirm the hostname, and choose Generate recovery token. Complete fresh MFA when prompted. Copy the secret immediately; it is shown once, lasts one hour, and can be used once on that endpoint record. A regular install token cannot replace an existing endpoint credential.
Complete recovery on that same endpoint
Run the normal signed installer on the same machine and enter the recovery token when prompted. Successful recovery rotates every previous credential for that endpoint. Return to Agent fleet, choose Refresh agents, and confirm a new heartbeat and the expected endpoint identity. If the token expires before use, issue another recovery token for this endpoint rather than erasing the record.
Revoke a compromised agent credential
Choose the device row’s Revoke action, verify the hostname in Revoke this agent?, and choose Revoke credentials. Every active credential for the device stops working immediately. This disconnects its ability to authenticate; it does not uninstall the software or erase its collected records. Re-enrollment requires an administrator-issued recovery token.
Erase a retired endpoint only when its records must be removed
Choose Erase, check the exact endpoint in Permanently erase endpoint data?, and read the list of records to be deleted. Erase endpoint data irreversibly removes the endpoint, credentials, inventory, telemetry, workforce records, command/script results, and terminal metadata. Only a minimal erasure audit fact remains. Enrollment afterward creates a new endpoint; use recovery, not erasure, when retaining history is the goal.
If something doesn’t work
The expected device is not found.
Clear loaded-only filters and inspect the loaded/total count. Open All endpoints and fleet filters for a broader search; hostname/agent-ID search is not transferred automatically to Endpoints.
The row is online but data is old.
Check Last heartbeat and the snapshot time, refresh, then inspect Outbox and endpoint telemetry. The last reported online state is not a live connectivity guarantee.
Recovery did not restore reporting.
Confirm the one-hour token was used once on the same endpoint and that the signed installer completed enrollment. Check local service/network errors before generating another token.