Best practice for clean up of stale local workgroup endpoints?

[ftech2020]

Apologies in advance if this is reviewed in the admin guide or KBs. I did review but was unable to find. I am reviewing some maintenance and cleanup processes while getting more familiar with our new EMS Forticlient system. We have a managed domain, and many domain joined endpoints process as expected when moved around to different OUs. I am specifically focused on devices that are not domain joined and are in local groups, or register in the lapse between an LDAP sync and get a duplicate endpoint object placed in local groups.

We can create a manual process to verify removal of endpoints from EMS when they are retired or otherwise removed from the org, but the challenge is that many devices out in the world just kind of drop off over time for whatever reason and we never get notified. They get stuck in a drawer as a loaner, or put in a pile during a move, and never get reconnected. When they're found, they're obsolete and retired, often without notifying IT (in our org, individual business units own the assets, not IT).

Anyone familiar with any kind of an automated process we might be able to leverage to delete or move in a staged process for non-domain joined endpoints from EMS? Ideally something like x days with no check in to management? In a review of the admin guide I'm only seeing one off manual deletion. Because we are right at the start of our initial rollout, there is a lot of stale data both from AD, and now some of those one off local non domain joined endpoints. AD we can manage by polling some of the attributes on the objects, but these local devices I can't wrap my head around a best way to audit and get out of management.

[ftech2020]

Ping...