Device marked as not compliant even it should be marked as compliant

Hi preuley30! First and foremost: KurtBMayer's solution is obviously the correct solution.

I do want to point out that assigning a "Windows" compliance policy to a user (like MrNeo mentions) is absolutely valid. In fact, I'd prefer it that way. A user (and its assigned privileges) mandates a certain level of device security, on any (in this case Windows) device they use.

Now, that isn't always possible, so I'm not saying that assigning them to devices is bad practice, either. I'd just only use it for special circumstances.