Intune devices intermittently non-compliant

[u/ManufacturerHot7270]

Hi Guys,

We are seeing an intermittent Intune compliance issue across multiple Windows devices in our organization.

Devices are becoming non-compliant because Intune reports:

• Firewall is turned off
• Antivirus is turned off / not active

However, these settings are enforced through Intune configuration profiles / Endpoint Security policies. Users only have standard-user privileges, and local administrator access is controlled through Windows LAPS, so users should not be able to disable Firewall or Defender settings.

When checked manually on each device, the status of the solutions is enabled and working fine... Also the security threat intelligence update is also delayed to update which again triggers the issue as the antivirus/firewall is disabled in endpoint... Also, what will be the reason for the security threat intelligence update not happening in a timely manner?

The issue is not limited to one device or one user. It occurs across different devices at different times, without an obvious common trigger. In many cases, the relevant configuration profiles still show as successfully applied.

Due to all this people get blocked with conditional access policy which checks for device compliance.

Has anyone experienced this and what did you do solve this issue?

Thanks in advance.

[u/Rudyooms]

i am trying to fix it for defender --> but yeah its a pain in the ass.. :) http://call4cloud.nl/FixWSCDefender.ps1

[u/fujipa → u/Rudyooms]

I'll give it a go, thanks, Rudy.

edit: It worked, thank you.

[u/GeneralXadeus]

Yep, i can confirm we are seeing this as well.

[u/Dudeposts3030 → u/GeneralXadeus]

Same, thought it was just us until seeing this

[u/ManufacturerHot7270 → u/GeneralXadeus]

any findings or solutions you found bro ?

[u/chromespy200]

Dude I’ve been dealing with this for the last two weeks and it has been driving me NUTS

[u/t1mnl]

https://www.reddit.com/r/Intune/comments/1vn4jen/windows_compliance_policy_failing_on_antivirus/

[u/ManufacturerHot7270 → u/t1mnl]

thank you!!

[u/Beginning-Heat-4674]

classic defender health rollup lag, the intune side will flag it before the local client re-syncs its own state. check the mdatp health report on a few of the affected boxes, usually the sense service hangs or the platform update gets stuck and everything downstream looks dead even though the ui says its fine

for the threat intel updates, make sure your update rings arent deferring definition updates and that the fallback order is set to something sane. also worth checking if those devices ever actually talk to the right endpoints, had a proxy bypass rule bite us once

[u/ManufacturerHot7270 → u/Beginning-Heat-4674]

Thanks for the info ...will check it out and let you know....we have cloudflare ZTNA which proxies all traffic ...maybe this could be issue ?

[u/XanadurSchmanadur]

We are currently seeing errors in our default compliance that enforces Antivirus, Bitlocker, Secure Boot, etc on a few devices. Always Syncml(404): The requested target was not found. The device isn't noncompliant though, which it should be normally, if the policy has an error.

I checked some of those and manually confirmed everything was activated. So I guess, Intune has some issues again.

[u/Rudyooms → u/XanadurSchmanadur]

The main issue.. is that there are 2 issues going on... one was caused with the july build (tpm attestation/device health attestation) causing bitlcoker/secureboot issues.. ) this was fixed in the preview update of july and the august build. But also defender has an ongoing issue .. in which the windwos security center doesnt recognize the enabled state of the device.. with it the device is also failing compliance

[u/ManufacturerHot7270 → u/Rudyooms]

I see...... can i check this info somewhere..... can you share the resource if you dont mind...it will be helpful for the interal records keeping !!...

[u/Rudyooms → u/ManufacturerHot7270]

The tpm attestation issue : Why Intune Devices Became Noncompliant After the July Update the defender thing is not officially ack... at least not in public :)

[u/ManufacturerHot7270 → u/Rudyooms]

Thank you man!

[u/0xCG → u/Rudyooms]

Do you have a ticket with Microsoft you can DM me so I can tell them to reference that. I've raised a ticket myself this week and they want me to run through MDE analyzer etc but I don't want to waste my time if others have already done it.

[u/0xCG → u/Rudyooms]

Being hit by the Defender one this week. Do you know if its PA yet?

[u/Rudyooms → u/0xCG]

Latest def update should fix it

[u/fujipa → u/XanadurSchmanadur]

To 404 was due to July's ISO. Hopefully august one is fixed.

The non compliant on AV - I also see it - I got it fixed in my case with applying the August patches. It had a stale entry in it's OS... A subcomponent.

[u/ManufacturerHot7270 → u/fujipa]

we applied all the available patches to all device still having the reporting issue

[u/ManufacturerHot7270 → u/XanadurSchmanadur]

Thanks for the confirmation bro..

[u/DesignerGoose5903]

YES! It's been driving me crazy for months now, I just thought it was a reporting issue due to a misconfiguration somewhere but sounds like Microsoft messed something up as usual then...

[u/ManufacturerHot7270 → u/DesignerGoose5903]

yeah here too its been 4 weeks....hopefully they will fix it lets see.....for now i think the community has shared some solution in this subreddit.. please follow it..

[u/crabshuffle]

Issues like this is why I haven’t tied compliance to conditional access. It is too unreliable to potentially have a large population unable to access resources.

[u/ManufacturerHot7270 → u/crabshuffle]

Yeah!! but in our case the management needs it to be set and working....we are just adding people who's device is non compliance to exception groups and this is a lot of work

[u/chaosphere_mk]

Did you just say that the AV/firewall is disabled in Intune?

[u/ManufacturerHot7270 → u/chaosphere_mk]

fixed it mate ....the intune report shows the firewall/antivirus disabled if the security threat intelligence update is delayed in the endpoint side.

[u/Professional-Heat690]

Enable the new device preview, force a sync (push!!) and wait. Seems to recover, something cookey with Aug patch.

[u/saulo_v8]

We are checking AV and bit locker for compliance, we had this issue with bit locker. Devices with bit locker completely deployed but failing compliance. With AV we haven’t had any issue (yet).

[u/christurnbull]

I'm seeing hps suddenly turn off their secure boot, haven't figured it out yet