On September 16th, 2026, Liongard will be deploying a fix for a known issue affecting the Windows Workstation Inspector. As part of this deployment, you may experience a one-time change alert. This article explains what to expect, why it's happening, and what (if anything) you need to do.

A bug was identified in the Windows Workstation Inspector where local group membership could report as empty, even on machines that have members configured. This affects local groups broadly (Administrators, Remote Desktop Users, Backup Operators, etc.), not just one specific group. This has been corrected.

When the fix is deployed, you may see a single change alert generate for workstations where local group membership was previously reporting as empty, and a Change Detection or Actionable Alert rule is configured against that data (most commonly on the Local Administrators group). This is expected and is a direct result of the fix being applied — it is not indicative of an actual change in local group membership on the machine.

This alert will not repeat after the deployment is complete.

No action is required. You can safely dismiss any change alert that fires on or around September 16th related to Windows Workstation local group membership.

If you have alert notifications configured (email, PSA, etc.), you may want to give your team a heads-up that a one-time alert is expected, so it isn't mistaken for a real issue.

If you continue to see repeated local group membership change alerts after September 16th, or the reported members for a group don't match what you see running Get-LocalGroupMember -Group "<Group Name>" locally on the affected machine, please contact Liongard Support so we can investigate further.