I'm also having the same problem.. I've got like 26 machines showing as passed/active on a lot of deployments. They never change their status..I have't really had the chance to actually check a client manually, but it's for sure a problem if you are relying on reports - You never know it the clients has the app/update... At my end, most of the machines that states this are internet faced.. Does the client report less if it's internet faced? strange and really annoying problem..