AV Status shows disabled on end point

Morning,  When I run a filtered report on machines via the security center I see around 23 (out of 800+) machines that are active but show as AV Disabled.  Remoting to a few of these machines, I see that Defender is indeed running and doing its thing. Normally I get a warning that an endpoint is disabled but none on these

Any idea?