---
title: "Check an endpoint's effective configuration"
description: "See the policy one endpoint resolved to, which profile decided each value, and whether the agent applied it."
url: "https://support.outpostplatform.com/automation/effective-configuration/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Profiles > Effective config resolves the merged policy for one endpoint and, optionally, one signed-in person. Shows the profiles applied in merge order, each setting's value, what decided it (catalog default, rank, mandatory, compliance floor), the winning profile, and the agent's enforcement state. Needs policy:read."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "policy:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/effective-configuration.md"
license: "CC BY 4.0"
---

# Check an endpoint's effective configuration

The effective configuration is the policy one endpoint ends up with after
every profile that applies to it is merged. Use this page when a setting is not
what you expected on an endpoint: it shows the value, which profile won it, why,
and what the agent reported doing about it. Outpost resolves it on the server,
so the page shows the same answer the endpoint receives.

## Before you begin

- You need the `policy:read` permission.
- On the MSP plan, open the client's workspace first.

## Resolve the configuration

1. Go to **Profiles** > **Effective config**.
2. In **Endpoint**, choose the endpoint.
3. Optionally, in **Signed-in person**, choose a person. Profiles assigned to a
   person or a user group apply on top of the endpoint's, so the same endpoint
   resolves differently depending on who is signed in. Leave it at **Nobody
   signed in** to see the endpoint's own policy.
4. Select **Resolve**.

## Preview before enrollment

1. Open a site from **Endpoints** > **Sites**, or open the enrollment page.
2. Select **Preview policy for new endpoints**.
3. Choose the **Site** and **Operating system**, then select **Resolve**.

The result is marked as a preview of what an endpoint enrolled into that site
would receive. It assumes no device group, tag, user, or MDM memberships. No
endpoint has reported this configuration, so the preview is not evidence that
settings have been applied. After enrollment, resolve the actual endpoint to
check its delivery and enforcement evidence.

## Read the result

**Resolved for** shows the endpoint, the **Operating system** that selected any
per-OS variants, the person, the **Config hash**, the **Last agent report**,
and the **Target frameworks** declared for this scope.

**Profiles applied** lists every profile that contributed, in merge order, with
its **Rank**, whether it is **Mandatory**, and how many **Settings won**. A
profile marked **Outranked everywhere** applies but won nothing, which usually
means an assignment somebody expected to matter is outranked. When no profile
applies, every value is the catalog default.

If the page shows **Monitor only. This endpoint reports what it observes but
corrects nothing.**, `enforcement.mode` is `monitor` for this endpoint. See
[Enforcement mode](/automation/profiles/#enforcement-mode).

The settings table has one row per setting:

| Column | What it shows |
| --- | --- |
| **Setting** | The setting key. |
| **Value** | The resolved value. **Clamped from** shows the value your profiles set when a compliance floor replaced it. |
| **Delivered by** | How the setting reaches its destination, including **Agent (script environment)** for script settings. |
| **Enforced** | What the agent reported for this setting. See the next table. |
| **Decided by** | **Catalog default** (no profile set it), **Won by rank**, **Mandatory**, or **Compliance limit**. |
| **Winning profile** | The profile whose value survived, or **No profile**. |
| **Also set by** | Every other profile that set this key and lost. |

The filters narrow the table: **Only settings a profile touched**, **Only
values a compliance floor moved**, **Only values no narrower scope can
change**, and **Only problems**, which lists failures and uncorrected drift.

### Enforcement states

| State | Meaning |
| --- | --- |
| **Applied** | The endpoint matches policy. |
| **Pending** | Not converged yet, and no action is needed: a change is still running, such as a volume being encrypted, or the endpoint has not reported against the newest policy. |
| **Pending reboot** | Written, and takes effect when the endpoint restarts. Outpost never restarts an endpoint to apply a setting. |
| **Drift detected** | The endpoint disagrees with policy right now. In monitor mode nothing will correct it. |
| **Failed** | The agent could not apply or verify the value. The detail under the badge says why. |
| **Not supported on this OS** | This operating system build has no mechanism for the setting. It is a permanent answer, not a failure to retry. |
| **Monitor only** | Read and not written, because the endpoint is in monitor mode. |
| **Waiting on key escrow** | Drive encryption is waiting until your Outpost confirms it has stored the recovery key. |
| **Stale report** | The endpoint's newest report is too old to trust. |
| **Not reported** | The endpoint reported, and said nothing about this setting. |
| **No report yet** | The endpoint has never reported on its policy. |

When the endpoint reads a different value from the resolved one, the cell also
shows **Applied** followed by the value the endpoint reads and the time it
reported it.

### Script delivery {#script-delivery}

For settings delivered by **Agent (script environment)**, agent 0.3.0 or later
reports whether it received the resolved script settings:

| State | Meaning |
| --- | --- |
| **Applied** | The agent confirmed the current script settings. |
| **Pending** | The agent confirmed earlier script settings, but not the current ones. |
| **Not reported** | The agent has not confirmed script settings. This includes agents older than 0.3.0. |

Profile edits, assignment changes, site moves, and server-role tag changes
send updated settings to connected endpoints right away. Check **Applied**
to confirm delivery; saving a profile alone is not endpoint evidence.

### Merge problems

If the page shows **The merge worked around** a number of defects, Outpost
resolved the policy with a safe fallback and lists why:

| Message | What to do |
| --- | --- |
| **A profile sets a key the catalog does not define. It was skipped.** | Remove the setting from the profile. |
| **A stored value does not match the type the catalog declares. The catalog default was used.** | Set the value again on the profile. |
| **Two mandatory profiles set this key. The catalog merge rule decided it, not rank.** | Decide which lock should stand and remove the other. |
| **Two profiles at the same rank set this key. Give them different ranks.** | Change one assignment's rank. |
| **A scope could not be expanded, so some assignments may not have been considered.** | Resolve again. If it persists, contact support. |

## Verify a change

After you change a profile, resolve the endpoint again. **Decided by** and
**Winning profile** change as soon as the profile is saved. The **Enforced**
column changes when the agent next reports, which an online endpoint does when
it receives the new policy and at least once every 24 hours.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| Every row shows **No report yet** | The endpoint has never sent a policy report, for example because it has been offline since the profile applied. | Check that the endpoint is online. See [Endpoints](/endpoints/). |
| **Stale report** on the endpoint | The endpoint has stopped reporting. | Check the endpoint's connection and agent service. |
| A row shows **Failed** repeatedly | The agent's write or check failed. | Read the detail under the badge. Fix the cause on the endpoint, or remove the setting from the profile. |

## Next steps

- [Create and assign a profile](/automation/create-a-profile/)
- [Policy settings reference](/automation/policy-settings/)