You have assigned one or more policies to a machine. The policies contain "Set Credential" and "KSDU Assign Profile" policy parts.
Once these policies have been applied to a machine and a policy compliance check has run, the policy shows "Out of Compliance"
When changing the credentials of a machine, either through Agent Tab -> Set Credential, through the KSDU pages, or Policy management, a background validation of the credentials is started automatically.
Until this validation completes, not action can be taken on those endpoints in regards to KSDU - you cannot assign profiles, deploy software or anything else.
If the machines are not online or are running other procedures at the time that the policy runs on that machine, the application of the credentials triggers this validation, but because the agent is unable to validate, the subsequent application of the KSDU profile will fail.
RESOLUTION / WORKAROUND
To avoid this, re-process the policies for the affected machines while the agent is online, so that the validation can happen, and the profile assignment is able to completes.
This is a known limitation of this combination. There is no way for these two policy settings to run together when the validation cannot complete immediately, but they can run on their own, or when the agents are online at the time that the policy is applied.
May 2015 - This issue is resolved in R9.1. If you are experiencing this issue in an earlier version, you should update to R9.1