It remains online because the OfficeScan client failed to notify the server regarding its status.

OfficeScan clients notify the server when:

• Unloading the OfficeScan client by right-clicking the OfficeScan icon and then selecting Unload
• Uninstalling the OfficeScan client via Add/Remove Program or with the use of the OfficeScan uninstall program
• Stopping the OfficeScan client services via the services console
• Moving the OfficeScan client from one server to another

OfficeScan client will not notify the server when:

• It gets disconnected from the network - either cable is unplugged or NIC is disabled
• Its client processes were killed/terminated using the Task Manager or other third-party tools (e.g. Process Monitor)
• Its installed files/components/registries was manually removed or deleted.
• It was uninstalled using an uninstall tool that strips off and delete installed OfficeScan client components, files and directories
• Its hard drive was reformatted or reimaged without properly removing the OfficeScan client components

To resolve this issue:

1. Enable and configure the Scheduled Verification.
   1. On the OfficeScan web console, go to Agents > Connection Verification > Scheduled Verification.
   2. Set this to Daily (Default).
   3. Save the changes.
2. Configure the Automatic Update (Networked Computers).
   1. On the OfficeScan web console, go to Updates > Agents > Automatic Update.
   2. In the Event-triggered Update, make sure that the Initiate component update on clients immediately after the OfficeScan server downloads a new component option is selected.
   3. Save the changes.