Reduced Functionality Mode (RFM) typically occurs when a host cannot verify its license or activation status with a Key Management Service (KMS) server. This situation often arises when a host is placed in network containment, preventing it from communicating with the KMS server. Therefore, the most likely culprit causing these hosts to be in RFM is that the host was placed in network containment from a detection.