Device restart status

Applies to:

• Microsoft Defender Vulnerability Management
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender XDR
• Microsoft Defender for Servers Plan 1 & 2

Security recommendations in Defender Vulnerability Management can help reduce your overall vulnerability exposure and your exposure score. A robust update process is key when it comes to addressing these recommendations in your organization. If an update hasn't completed for some devices due to a pending restart, the effect of addressing the security recommendation isn't reflected in your exposure score.

The Pending restart tag helps you identify devices in this state so you can take action, and it gives you visibility into why some update actions taken aren't being reflected in your exposure score.

Note

The tag is currently available for Windows(OS) updates and KB corrections.

Tip

Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to sign up for a free trial.

View the device restart status

The device restart status is visible in the following experiences in the Microsoft Defender portal.

Security recommendations page

On the security recommendations pages, filter by the Pending restart tag to only see security recommendations with devices pending a restart.

Software page

On the software page filter by, the Pending restart tag to see missing KBs with devices that are pending a restart:

Related articles

• Security recommendations
• Vulnerabilities in my organization