Roaming Symantec Endpoint Protection clients are the clients that intermittently connect to the management server. Roaming clients access the Internet at different locations, such as airports, hotels, or at other companies, where they are at higher risk. Symantec Endpoint Protection Manager provides on and off-network protection for these client computers using location awareness.
In 14.1 and earlier, roaming clients send critical events to the management server only when they are connected. As of 14.2, roaming clients automatically send critical events to the cloud console when the clients cannot connect to the management server. After the roaming client reconnects to the management server, the clients send any new critical events on the management server. The client is also no longer considered to be roaming.
Use the list of critical events as a way to strengthen the security policies on the Symantec Endpoint Protection Manager. For example, suppose Employee1's client has a higher number of denial-of-service attacks when Employee1 is located in a particular hotel. Therefore, you can create a location for that hotel and enable denial of service detections in the Firewall policy.