MDE - Devices are displayed in the exposed devices even though the recommendations have been enforced

Question

Hi all,

We have problems with the Microsoft Defender vulnerability management. E.g. with the recommendation “Set ‘Maximum password age’ to ‘60 or fewer days, but not 0’”. We have set this setting via GPO and deployed it to the clients/servers. This was also verifiably implemented on the devices. Nevertheless, the Defender Portal still reports the devices as exposed. Since the clients and servers communicate properly with the Defender portal, I cannot explain the behavior even after weeks of waiting. Does anyone have any ideas?

Translated with DeepL.com (free version)

Answer 1

Hello Lars Wegner,

This could be because of any of the following reasons,

1. GPO not successfully applied on the clients/servers: Check a couple of devices to confirm if GPO is applied.
2. Policy propagation: Sometimes, GPO changes might take time to propagate fully. This could be a reason if GPO is not applied to the devices.
3. Reporting Delays: Confirm if the devices are able to communicate the status back to defender.

If all the above are checked, please reach out to support to address this further - Contact Us - Microsoft Support

If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.