To identify computers that need a restart for completing threat remediation, the administrator should:
* Steps for Identification and Action:
* View the Computer Status login the Symantec Endpoint Protection Manager (SEPM) to see if any computers are flagged as needing a restart.
* Once identified, the administrator can go to theRisk logand run a command to initiate a restart on those systems, thereby completing the remediation process.
* Why This Method is Effective:
* TheComputer Status logprovides comprehensive information on the current state of each endpoint, including whether a restart is pending.
* Risk log commandsenable administrators to remotely trigger actions such as reboots on endpoints impacted by malware.
* Why Other Options Are Incorrect:
* Other options suggest using logs likeSONARorAttack logsto trigger restarts, which do not provide the necessary functionality for identifying and restarting systems in need of final remediation.
References: Using the Computer Status log along with the Risk log in SEPM ensures administrators can efficiently identify and restart infected systems.