What could cause your Windows host to be in Reduced Functionality Mode?

Windows hosts commonly enter Reduced Functionality Mode when the Windows kernel changes and CrowdStrike has not yet certified that kernel for full sensor operation. This can happen after Microsoft updates. RFM is a protective mode that prevents compatibility problems while allowing the sensor to continue operating at reduced capacity. Loss of internet connectivity may affect cloud communication but does not by itself place the sensor in RFM. Network containment restricts network traffic but is unrelated to kernel compatibility. A sensor update policy issue could cause version drift, but RFM specifically relates to kernel support and sensor compatibility. The course guide explains that Windows RFM is most commonly tied to Microsoft updates and kernel certification status.