You wish to understand how the online status (green dot) is determined.
There are two methods used to determine online status:
- Heartbeat, which is nothing more than an ICMP packet sent from the console computer to the target.
- Inventory Scan. If you scan a computer that currently shows as offline (the absence of a green dot) but the attempted scan works, meaning the target was actually online, then the online status will change to a green dot.
- If your computers do not have ICMP Echo Request enabled (firewall or certain types of AV suite software) then they can appear offline but have their status change to online when they receive a successful scan.
The Offline Policy (File > Preferences > Scanning) is important. If you have your Policy set to Do No Scan then each scan attempt will first try to ping the target computer. If the target does not respond then the scan won't be attempted.
If you scan a computer and it shows online and then shortly after goes back to offline, the Heartbeat probably didn't receive the ping response in time. By default the Heartbeat will wait over 2 seconds for a response before moving on to the next computer. Slow response time can be linked to slow DNS resolution or network problems related to high latency.
Windows Firewall Ports and Exceptions