---
title: "Bring endpoints back from storage"
description: "How an endpoint that was turned off for months reconnects with an expired agent certificate, how to set the grace period, and how to spot returns."
url: "https://support.outpostplatform.com/agent/bring-endpoints-back-from-storage/"
product: "agent"
type: "how-to"
status: "draft"
ai_summary: "Depot accepts an expired but otherwise valid agent certificate for a grace period (default 18 months, 0 to 36, 0 off) and renews it on first check-in. Refused: revoked, retired, superseded, other client, past grace. Set on the Returning devices card. Returns raise an info alert, a Returned row on Overview, and endpoint.returned in the audit log."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "client:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/agent/bring-endpoints-back-from-storage.md"
license: "CC BY 4.0"
---

# Bring endpoints back from storage

An endpoint that was turned off for months, such as a spare laptop in a
cupboard or a computer used only one season a year, reconnects on its own when
you turn it on, even though its agent certificate expired while it was off.
This page explains when Outpost accepts an expired certificate, how to change
or turn off the grace period, and how to see which endpoints came back.

## How returning endpoints reconnect

The agent authenticates to your Outpost with a certificate that is valid for
90 days. The agent renews it automatically 30 days before it expires, so a
computer that is on regularly never sees it expire. A computer that is off for
longer than its certificate has left, which can be as little as 30 days, comes
back with an expired certificate.

Your Outpost still accepts an expired certificate for a grace period after it
expired, 18 months by default, as long as nothing else is wrong with it. On
its first check-in, the agent gets a new certificate. The endpoint then
catches up as usual: it installs any [agent update](/agent/updates/), and
receives patches and policy on its normal schedule.

This works on Windows, Linux, macOS, FreeBSD, and OpenBSD, and needs no agent
update.

An expired certificate is refused when any of these is true:

- The certificate was revoked.
- The endpoint was [retired](/agent/retire-and-uninstall/).
- The endpoint has a newer certificate. The older one keeps working for 7 days
  after the newer one was issued, so an agent whose renewal was cut off can
  try again.
- The certificate was issued for a different client.
- The certificate expired longer ago than the grace period.

A refused endpoint cannot reconnect. Enroll it again. See
[Bring a computer back](/agent/retire-and-uninstall/#bring-a-computer-back).

:::caution
A lost, stolen, or discarded computer that was never retired can reconnect
within the grace period. Retire every endpoint you dispose of, because
retiring revokes its certificate. For a client that needs stricter control,
set the grace period to `0`.
:::

## Before you begin

- Changing the grace period needs the `client:manage` permission. Reading it
  needs `client:read`. See [Roles and permissions](/depot/roles-and-permissions/).
- Pioneer AI and connected MCP clients can read the grace period but never
  change it.

## Change the grace period

The grace period is set per client, on the **Returning devices** card. Where
the card is depends on your console:

- **On the MSP plan, for a client**: in **Clients**, select **Record** on the
  client's row. The card is on the client's record.
- **On the MSP plan, for your own practice's endpoints**: **Settings** >
  **Security policy**.
- **On every other plan**: **Settings** > **Security policy**.

To change it:

1. On the **Returning devices** card, choose how long the grace period is:
   - **Use the default (18 months)** follows the Outpost default.
   - **Set a number of months** sets your own.
2. If you chose **Set a number of months**, enter a whole number from `0` to
   `36` in **Months after the certificate expires**. `0` turns the grace
   period off.
3. Select **Save**.

**In effect now** shows the grace period that applies, or **off**. The change
applies to the next connection from any endpoint of that client. The change is
recorded in the audit log as `organization.agent_cert_grace_updated`, with the
value before and after.

## See which endpoints came back

When an endpoint checks in after more than 30 days offline, Outpost records
it in three places.

**An alert.** An info alert in the **Offline** category, titled
**Endpoint back after 212 days offline:** followed by the endpoint's name. Its
detail gives the date the endpoint was last seen and, when the grace period
was used, the date its certificate expired. An info alert notifies nobody
unless an [alert rule](/service-desk/alert-rules/) includes info alerts. It
resolves as **Aged out without clearing** 7 days after it was raised. An
endpoint whose `monitoring.agent_offline_alert_minutes` policy setting is `0`
raises no alert. See [Alerts](/service-desk/alerts/).

**The endpoint's Overview.** For 30 days, the **Status** card on the endpoint's
**Overview** tab shows a **Returned** row after **Last seen**, with the date it
came back and how long it was offline. When the grace period was used, the row
ends with **certificate renewed under the expired-certificate grace**, or
**certificate renewal pending** until the agent has its new certificate. See
[Endpoint details](/endpoints/endpoint-details/).

**The audit log.** In **Settings** > **Audit logs**, on **Console actions**:

| Action | When it is written |
| --- | --- |
| `endpoint.returned` | The endpoint checked in after more than 30 days offline. Records when it was last seen, how many days it was offline, and whether the grace period was used. |
| `endpoint.cert.grace_accepted` | The endpoint connected with an expired certificate under the grace period. Records the certificate's expiry date, the grace period, and the date the grace period ends. |
| `cert.renew` | The agent renewed its certificate. After an expired certificate, the entry also records the previous certificate's expiry date. |

See [Audit log](/depot/audit-log/).

## Verify

After you turn on a computer that was in storage, wait for it to check in,
then open the endpoint. **Last seen** is a moment ago, and the **Returned** row
reads **certificate renewed under the expired-certificate grace**.

If the endpoint does not come back, see
[Troubleshoot the agent](/agent/troubleshooting/#expired-certificate).

## Set the grace period through the API

`GET /api/v1/organization/agent-cert-grace` reads the grace period and
`PUT` changes it. On the MSP plan, address a client with
`/api/v1/clients/<client-id>/organization/agent-cert-grace`. The request body
must contain `graceMonths`: a whole number from `0` to `36`, or `null` for
the default.

```json
{ "graceMonths": 6 }
```

The response also carries `effectiveGraceMonths`, `defaultGraceMonths`, and
`maxGraceMonths`. A value out of range, or a body without `graceMonths`, is
refused with status 422. See the [Depot REST API](/api/generated/depot/).

## Related

- [The Outpost agent](/agent/)
- [Retire or uninstall the agent](/agent/retire-and-uninstall/)
- [Agent and tray updates](/agent/updates/)
- [Alerts](/service-desk/alerts/)