We have had several endpoints where Windows Defender shows as healthy and managed, but the settings on the endpoint are out of sync with the managed settings for some reason. This is resolved by setting the endpoint to audit mode, and then flipping it back to enforced mode, but I feel like we really need a way to be able to get these reported to us, and either have an automated remediation of doing this, or at least notify us so that we can perform this action as needed vs finding these machines by random chance.
