Windows - Maintenance Tasks - Cleanup Disconnected Automox Devices

What the disconnected endpoint cleanup Worklet does

This Automox Worklet™ identifies and removes endpoints that have been disconnected from your Automox organization beyond a specified age limit. The Worklet uses the Automox API to query your organization for all endpoints, calculates the time elapsed since each endpoint last disconnected, and compares it against a configurable threshold (default 120 days).

By default, the Worklet runs in dry-run mode, which identifies qualifying endpoints without deleting them. When enabled for live execution, it permanently removes old disconnected endpoints from your console, freeing up licenses and improving data accuracy.

Why remove stale disconnected endpoints

Disconnected endpoints that linger in your console consume licensing capacity and clutter your endpoint inventory. Over time, endpoints that have been removed from your network or replaced remain visible in your Automox organization, making it difficult to get an accurate picture of your active infrastructure.

Automating stale endpoint cleanup improves console performance, frees up licensing for active endpoints, and ensures your reporting reflects your actual network state. This Worklet eliminates the manual work of identifying and removing old endpoints one by one.

How endpoint disconnection detection and removal works

1. Evaluation phase: The Worklet queries the Automox API to retrieve all endpoints in your organization. For each endpoint with a valid last_disconnect_time, it calculates the number of days since disconnection and compares that value against your configured age limit. Excluded endpoints are skipped based on hostname matching.

2. Remediation phase: If dry-run is disabled, the Worklet invokes the Automox API delete endpoint operation on each qualifying endpoint. The Worklet logs successful and failed deletion attempts, reporting which endpoints were removed and which removal operations encountered errors.

Stale endpoint cleanup requirements

• Automox Platform API key configured as a Shared Secret named apiKey

• Automox Organization ID (orgID) for the zone containing endpoints to clean

• Worklet must be configured to run against a single endpoint using Endpoint Targeting to prevent unintended deletions

• ageLimit parameter (days before removal, default 120)

• Optional excludedDevices list to protect specific endpoints from deletion

• dryRun parameter (enabled by default to preview deletions without making changes)

Expected endpoint inventory state after cleanup

After the Worklet runs in live mode (dryRun set to false), all endpoints that exceeded your age limit are permanently removed from your Automox organization. This cleanup is irreversible. Your endpoint inventory will reflect only active and recently connected endpoints, reducing console clutter and improving reporting accuracy.

If you run the Worklet with dry-run enabled (the default), it identifies endpoints that would be deleted but leaves your inventory unchanged. You can review the dry-run output to verify the Worklet targets the correct endpoints before enabling live deletion. To re-onboard deleted endpoints, you must reinstall the Automox agent on those machines.

How to validate cleanup disconnected automox endpoints changes

1. Run this Worklet on a pilot Windows endpoint and review evaluation output for cleanup disconnected automox endpoints.

2. Confirm Automox activity logs show successful completion and exit code 0.

3. Verify endpoint state using checks aligned to evaluation script logic, such as endpoint-Targeting, Secrets-Management, Managing-Keys.

4. Validate remediation effects from script operations such as endpoint-Targeting, Secrets-Management, Managing-Keys, then rerun evaluation for compliance.