Check an endpoint's effective configuration

The effective configuration is the policy one endpoint ends up with after every profile that applies to it is merged. Use this page when a setting is not what you expected on an endpoint: it shows the value, which profile won it, why, and what the agent reported doing about it. Outpost resolves it on the server, so the page shows the same answer the endpoint receives.

Before you begin

• You need the policy:read permission.
• On the MSP plan, open the client’s workspace first.

Resolve the configuration

1. Go to Profiles > Effective config.
2. In Endpoint, choose the endpoint.
3. Optionally, in Signed-in person, choose a person. Profiles assigned to a person or a user group apply on top of the endpoint’s, so the same endpoint resolves differently depending on who is signed in. Leave it at Nobody signed in to see the endpoint’s own policy.
4. Select Resolve.

Preview before enrollment

1. Open a site from Endpoints > Sites, or open the enrollment page.
2. Select Preview policy for new endpoints.
3. Choose the Site and Operating system, then select Resolve.

The result is marked as a preview of what an endpoint enrolled into that site would receive. It assumes no device group, tag, user, or MDM memberships. No endpoint has reported this configuration, so the preview is not evidence that settings have been applied. After enrollment, resolve the actual endpoint to check its delivery and enforcement evidence.

Read the result

Resolved for shows the endpoint, the Operating system that selected any per-OS variants, the person, the Config hash, the Last agent report, and the Target frameworks declared for this scope.

Profiles applied lists every profile that contributed, in merge order, with its Rank, whether it is Mandatory, and how many Settings won. A profile marked Outranked everywhere applies but won nothing, which usually means an assignment somebody expected to matter is outranked. When no profile applies, every value is the catalog default.

If the page shows Monitor only. This endpoint reports what it observes but corrects nothing., enforcement.mode is monitor for this endpoint. See Enforcement mode.

The settings table has one row per setting:

Column	What it shows
Setting	The setting key.
Value	The resolved value. Clamped from shows the value your profiles set when a compliance floor replaced it.
Delivered by	How the setting reaches its destination, including Agent (script environment) for script settings.
Enforced	What the agent reported for this setting. See the next table.
Decided by	Catalog default (no profile set it), Won by rank, Mandatory, or Compliance limit.
Winning profile	The profile whose value survived, or No profile.
Also set by	Every other profile that set this key and lost.

The filters narrow the table: Only settings a profile touched, Only values a compliance floor moved, Only values no narrower scope can change, and Only problems, which lists failures and uncorrected drift.

Enforcement states

State	Meaning
Applied	The endpoint matches policy.
Pending	Not converged yet, and no action is needed: a change is still running, such as a volume being encrypted, or the endpoint has not reported against the newest policy.
Pending reboot	Written, and takes effect when the endpoint restarts. Outpost never restarts an endpoint to apply a setting.
Drift detected	The endpoint disagrees with policy right now. In monitor mode nothing will correct it.
Failed	The agent could not apply or verify the value. The detail under the badge says why.
Not supported on this OS	This operating system build has no mechanism for the setting. It is a permanent answer, not a failure to retry.
Monitor only	Read and not written, because the endpoint is in monitor mode.
Waiting on key escrow	Drive encryption is waiting until your Outpost confirms it has stored the recovery key.
Stale report	The endpoint’s newest report is too old to trust.
Not reported	The endpoint reported, and said nothing about this setting.
No report yet	The endpoint has never reported on its policy.

When the endpoint reads a different value from the resolved one, the cell also shows Applied followed by the value the endpoint reads and the time it reported it.

Script delivery

For settings delivered by Agent (script environment), agent 0.3.0 or later reports whether it received the resolved script settings:

State	Meaning
Applied	The agent confirmed the current script settings.
Pending	The agent confirmed earlier script settings, but not the current ones.
Not reported	The agent has not confirmed script settings. This includes agents older than 0.3.0.

Profile edits, assignment changes, site moves, and server-role tag changes send updated settings to connected endpoints right away. Check Applied to confirm delivery; saving a profile alone is not endpoint evidence.

Merge problems

If the page shows The merge worked around a number of defects, Outpost resolved the policy with a safe fallback and lists why:

Message	What to do
A profile sets a key the catalog does not define. It was skipped.	Remove the setting from the profile.
A stored value does not match the type the catalog declares. The catalog default was used.	Set the value again on the profile.
Two mandatory profiles set this key. The catalog merge rule decided it, not rank.	Decide which lock should stand and remove the other.
Two profiles at the same rank set this key. Give them different ranks.	Change one assignment’s rank.
A scope could not be expanded, so some assignments may not have been considered.	Resolve again. If it persists, contact support.

Verify a change

After you change a profile, resolve the endpoint again. Decided by and Winning profile change as soon as the profile is saved. The Enforced column changes when the agent next reports, which an online endpoint does when it receives the new policy and at least once every 24 hours.

If something goes wrong

Symptom	Cause	Fix
Every row shows No report yet	The endpoint has never sent a policy report, for example because it has been offline since the profile applied.	Check that the endpoint is online. See Endpoints.
Stale report on the endpoint	The endpoint has stopped reporting.	Check the endpoint’s connection and agent service.
A row shows Failed repeatedly	The agent’s write or check failed.	Read the detail under the badge. Fix the cause on the endpoint, or remove the setting from the profile.

Next steps

• Create and assign a profile
• Policy settings reference