Server 2008 R2. 255 Citrix users. Zero monitoring.

The problem

A 17-year-old server, marked “can be onboarded,” never enrolled.

A Windows Server 2008 R2, end-of-life since January 2020, sat in inventory marked “can be onboarded” but was never enrolled. It was serving 255 Citrix users daily with zero telemetry.

Forgotten infrastructure

A 17-year-old server running an end-of-life OS was serving hundreds of users daily through Citrix. It had been in the device inventory the whole time, just never enrolled, and was found through behavioral network analysis alone, with no agent required.

Attack surface fully mapped

The admin account, all 255 unique Citrix host connections, confirmed business-hours usage, and subnet neighbors running legacy applications were all mapped with no manual asset inventory needed.

Visibility without an agent