> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix Failed Device Checks

> Step-by-step remediation for each failing DSALTA device check on Windows, macOS and Linux — disk encryption, antivirus, screen lock and password manager.

When a device check fails, the fix is applied on the machine itself, then the Device Monitor reports the new value. This page covers each check in turn.

<Note>
  Each check passes only when **every** enrolled device meets it, so a single non-compliant machine keeps the check on Fail. Start with [No devices enrolled or assigned](#no-devices-enrolled-or-assigned) if you have not enrolled devices yet.
</Note>

## Disk encryption

**What is checked:** whether disk encryption is enabled — BitLocker on Windows, FileVault on macOS, LUKS on Linux.

**Windows**

1. Go to **Settings → System → Encryption** and enable **BitLocker**.
2. Or, from an admin prompt:

   ```powershell theme={null}
   manage-bde -on C: -RecoveryPassword
   ```
3. Verify:

   ```powershell theme={null}
   manage-bde -status C:
   ```

**macOS**

Go to **System Settings → Privacy & Security → FileVault** and select **Turn On**.

**Linux**

Enable LUKS encryption on the disk partitions.

<Warning>
  Store the recovery key somewhere safe before you enable encryption. Losing it can make the disk unrecoverable.
</Warning>

## Antivirus

**What is checked:** DSALTA looks for a running antivirus process. Detected products include Windows Defender, CrowdStrike, SentinelOne, Sophos, and ClamAV on Linux.

**Fix**

* Enable **Windows Defender**, or
* Install and run a supported third-party antivirus.

The process must be running to be detected, not merely installed.

## Screen lock

**What is checked:** whether screen lock is enabled and a password is required on wake.

**Windows**

1. Go to **Settings → Personalization → Lock screen → Screen saver settings**.
2. Enable a screen saver and set the wait time to **5 minutes or less**.
3. Tick **On resume, display logon screen**.

**macOS**

1. Go to **System Settings → Privacy & Security**.
2. Require a password after sleep or screen saver begins.
3. Set the delay to **5 minutes or less**.

**Linux (GNOME)**

Enable screen lock and set the idle timeout to **5 minutes or less**.

## Password manager

**What is checked:** whether a supported password manager process is present.

**Fix:** install and run one of the supported password managers — 1Password, LastPass, Bitwarden, KeePass, Dashlane, NordPass, RoboForm, Keeper, Enpass, or Proton Pass.

See [What data is collected](/guides/device-management/data-collected) for the full detection list.

## No devices enrolled or assigned

Two checks fail before any security setting is evaluated:

* **No devices enrolled.** The check reports Fail when an organization has no device records at all. Have employees complete the Device Monitor onboarding task — see [How Device Management works](/guides/device-management/how-it-works).
* **Device not assigned to an employee.** A device with no owner sits on the **Unmonitored** tab and keeps this check on Fail. Assign it from the row's ⋮ menu → **Assign to User** on the [Devices](/guides/data-library/devices) page.

## Stale check-ins

A device must report in within the last **7 days**. If a device stops checking in, the check fails even when its settings are correct.

Confirm the Device Monitor is still installed and running on the machine, and that the device has been online. The **Last Check** column on the Devices page shows when each device last reported.

## Firewall

<Info>
  **Recommended hardening, not a tracked check.** DSALTA does not currently collect firewall status as part of Device Management, so enabling the firewall will not change any check result. It remains good endpoint practice and several frameworks expect it, so the steps are included here for completeness.
</Info>

**Windows**

1. Go to **Settings → Windows Security → Firewall** and enable it.
2. Or, from an admin prompt:

   ```powershell theme={null}
   netsh advfirewall set allprofiles state on
   ```

**macOS**

Go to **System Settings → Network → Firewall** and select **Turn On**.

## After fixing

Once a fix is applied:

1. Click **Rescan** in the DSALTA Device Monitor.
2. The status updates automatically.
3. Failed checks move to **Pass**.
4. Evidence is refreshed.

<Check>
  Confirm the result on the [Devices](/guides/data-library/devices) page — the PW, HD, AV and SL columns show a green ✓ for each passing check.
</Check>

## Related pages

* [What Is Device Management?](/guides/device-management/overview)
* [How Device Management works](/guides/device-management/how-it-works)
* [What data is collected](/guides/device-management/data-collected)
* [Devices (Data Library)](/guides/data-library/devices)