# Preventing Security Misconfigurations **Last Updated On**: 23 Jul 2026 **7 minutes read** Endpoint Central continuously monitors all systems in your network for security misconfigurations and provides fixes to address them without impacting critical operations. ## Overview Most of the time, security configurations of network systems are unmanaged, improperly configured, or left as default. As organizations increasingly rely on complex IT infrastructures, the potential for misconfiguration grows. There might be chances for default credentials, inactive or disabled firewall and antivirus, elevated privileges, and open shares that might arise security concerns. A misconfigured system may leave an organization vulnerable to cyberattacks such as data breaches, ransomware, and denial-of-service attacks. Thus, identifying and addressing misconfigurations promptly is critical to maintaining the integrity, availability, and confidentiality of systems and data. Endpoint Central uses predefined templates for security configurations designed to harden your systems. These templates are curated from CIS (Center for Internet Security) and STIG (Security Technical Implementation Guide) benchmarks, ensuring adherence to industry standards. Any deviation from these templates will be listed as a misconfiguration and the console will provide necessary fixes or resolutions to address the same. Applies to: - Windows - Linux ## Viewing the System Misconfigurations To view the security misconfigurations present across the managed computers, navigate to **Threats & Patches → Threats → System Misconfiguration**. All misconfigurations are listed in this window. Under **Category**, you can see the misconfiguration type. Under **Affected Systems**, you can see the count of managed computers with that misconfiguration — clicking on the count shows the names of affected systems individually. Under **Action**, you can see whether a fix is available, and if so, whether a reboot is required under the **Reboot Required** column. Click the **Filters** button to filter and prioritize misconfigurations based on specific criteria. ![System Misconfigurations view listing misconfiguration categories, affected systems count, fix availability, and reboot required status](https://www.manageengine.com/products/desktop-central/help/images/vm1.png) System Misconfigurations view showing misconfiguration categories, affected systems, and available fixes. ## Deploying Secure Configuration After filtering, select the misconfigurations for which you need to deploy the fix by enabling the checkbox beside that misconfiguration and clicking **Fix**. You will be redirected to the **System Configurations** window. ![System Configurations window showing Name, Description, Add Misconfiguration, Define Target, and Execution Settings sections](https://www.manageengine.com/products/desktop-central/help/images/vm2.png) System Configurations window for configuring and deploying misconfiguration fixes. ### Name and Description Under this section, you can name the configuration of your choice and add a description by clicking **Add Description**. ### Add Misconfiguration Under this section, you can see the selected misconfigurations for which you want to deploy the fix. Under the **Post Deployment Issues** section, you can see the impact this fix may have on the computer after deployment. If there are no impacts, **No Impact** will be mentioned. If you wish to add more misconfigurations to fix, click **Add Misconfiguration**, filter, and add the required ones. ### Define Target After choosing the misconfigurations to fix, you can include or exclude target computers of your choice under the **Define Targets** section. To learn more about defining targets, refer to [this page](https://www.manageengine.com/products/desktop-central/help/general/defining_targets.html). ### Execution Settings After defining the targets, configure the **Execution Settings** (optional). Under this section, if you want to configure notifications about this activity, select the **Enable Notifications** option. To learn more, refer to [this page](https://www.manageengine.com/products/desktop-central/help/configuration-management/configuring_execution_settings.html). ### Deploy After configuring the required settings: - Click **Deploy Immediately** to deploy fixes to a maximum of 200 computers right away, with the remaining selected computers receiving their fixes in their subsequent refresh cycle. - Click **Deploy** to deploy fixes to all selected computers in their subsequent refresh cycle. **Note** - System Misconfiguration status for each system will be updated after a [patch scan](https://www.manageengine.com/products/desktop-central/help/patch-management/patch-scan.html). - Sometimes, security settings might be inappropriately configured in Domain GPO and cannot be overridden from the console. To manually resolve these misconfigurations, refer to these [articles](https://www.manageengine.com/vulnerability-management/misconfiguration/#misconfig-index). - You can track the status of security configuration deployments from **Deployment → Security Configurations**. - If any misconfiguration fix deployment has failed on a computer, that computer will be listed under **Attention Required**. To view those computers, navigate to **Threats & Patches → Systems → Attention Required**, click **Failed Security Configurations**, select the computers where deployment has failed, and click **Deploy Failed Configuration** to reinitiate the deployment. ## Related - [Vulnerability Management Overview](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/vulnerability-management-overview.html) - [Vulnerability Assessment and Prioritization](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/assess-and-remediate-vulnerabilities.html) - [Vulnerability Remediation](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/vulnerability-remediation.html) - [Mitigating Zero-Day Vulnerabilities](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/mitigating-zero-day-vulnerabilities.html) - [Defining Targets](https://www.manageengine.com/products/desktop-central/help/general/defining_targets.html) - [Configuring Execution Settings](https://www.manageengine.com/products/desktop-central/help/configuration-management/configuring_execution_settings.html) - [Patch Scan](https://www.manageengine.com/products/desktop-central/help/patch-management/patch-scan.html)