Under Linux, the "Monitor Autostart Services" check reports all oneshot units that are, by design, inactive after running— getty@, e2scrub_reap, cloud-init, grub-*, snapd.*, pollinate, sshd-keygen, and many more. On Windows, it’s the same story with UsoSvc, wuauserv, BITS, sppsvc, and the hypervisor guest agents.
In our case, 15 out of 19 devices were flagged as critical, solely due to such hits. After populating the exception list—51 entries for Windows, 64 for Linux, and 88 for the Proxmox nodes—exactly two genuine findings remained that we would have previously overlooked amid the noise.
Suggestion: Include a well-maintained default exclusion list for each platform that users can expand rather than having to build from scratch. On Linux, the clean solution would be to not even consider `Type=oneshot` without `RemainAfterExit ` as “should work” in the first place.