Skip to main content
When a device check fails, the fix is applied on the machine itself, then the Device Monitor reports the new value. This page covers each check in turn.
Each check passes only when every enrolled device meets it, so a single non-compliant machine keeps the check on Fail. Start with No devices enrolled or assigned if you have not enrolled devices yet.

​
Disk encryption

What is checked: whether disk encryption is enabled — BitLocker on Windows, FileVault on macOS, LUKS on Linux. Windows
  1. Go to Settings → System → Encryption and enable BitLocker.
  2. Or, from an admin prompt:
  3. Verify:
macOS Go to System Settings → Privacy & Security → FileVault and select Turn On. Linux Enable LUKS encryption on the disk partitions.
Store the recovery key somewhere safe before you enable encryption. Losing it can make the disk unrecoverable.

​
Antivirus

What is checked: DSALTA looks for a running antivirus process. Detected products include Windows Defender, CrowdStrike, SentinelOne, Sophos, and ClamAV on Linux. Fix
  • Enable Windows Defender, or
  • Install and run a supported third-party antivirus.
The process must be running to be detected, not merely installed.

​
Screen lock

What is checked: whether screen lock is enabled and a password is required on wake. Windows
  1. Go to Settings → Personalization → Lock screen → Screen saver settings.
  2. Enable a screen saver and set the wait time to 5 minutes or less.
  3. Tick On resume, display logon screen.
macOS
  1. Go to System Settings → Privacy & Security.
  2. Require a password after sleep or screen saver begins.
  3. Set the delay to 5 minutes or less.
Linux (GNOME) Enable screen lock and set the idle timeout to 5 minutes or less.

​
Password manager

What is checked: whether a supported password manager process is present. Fix: install and run one of the supported password managers — 1Password, LastPass, Bitwarden, KeePass, Dashlane, NordPass, RoboForm, Keeper, Enpass, or Proton Pass. See What data is collected for the full detection list.

​
No devices enrolled or assigned

Two checks fail before any security setting is evaluated:
  • No devices enrolled. The check reports Fail when an organization has no device records at all. Have employees complete the Device Monitor onboarding task — see How Device Management works.
  • Device not assigned to an employee. A device with no owner sits on the Unmonitored tab and keeps this check on Fail. Assign it from the row’s ⋮ menu → Assign to User on the Devices page.

​
Stale check-ins

A device must report in within the last 7 days. If a device stops checking in, the check fails even when its settings are correct. Confirm the Device Monitor is still installed and running on the machine, and that the device has been online. The Last Check column on the Devices page shows when each device last reported.

​
Firewall

Recommended hardening, not a tracked check. DSALTA does not currently collect firewall status as part of Device Management, so enabling the firewall will not change any check result. It remains good endpoint practice and several frameworks expect it, so the steps are included here for completeness.
Windows
  1. Go to Settings → Windows Security → Firewall and enable it.
  2. Or, from an admin prompt:
macOS Go to System Settings → Network → Firewall and select Turn On.

​
After fixing

Once a fix is applied:
  1. Click Rescan in the DSALTA Device Monitor.
  2. The status updates automatically.
  3. Failed checks move to Pass.
  4. Evidence is refreshed.
Confirm the result on the Devices page — the PW, HD, AV and SL columns show a green ✓ for each passing check.