We have several Windows Servers that have SCEP installed and being updated from SCCM. SCOM is reporting them as having out of date definitions but when I log onto the server in question it says that SCEP is up to date with the latest definitions. This is happening daily to various servers, sometimes the same server again and again and sometimes different servers.
If you are getting the alert from the FEP 2010 MP, then there is an auto recovery task that runs after the alert is fired off, to force a definition update.
If you look at the properties of the alert, look at the Alert Context, and you should be able to see that the recovery task was run. or it is under history. I don’t have an example in front of me so I cant be sure.