Microsoft Defender for Endpoint not Onboarding

Trent Nolin 20 Reputation points
2024-10-30T16:38:23.8766667+00:00

Hello,

My team is having trouble onboarding Microsoft Defender for Endpoint because the Advanced Threat Protection Service won't start. It looks like the SENSE service is also not starting and is stuck in START_PENDING. I tried rebooting the device and updating the machine, but it did not work. Do you have any other suggestions? The SENSE service is also not showing up in the Services inventory.

01573b9b-0e97-4b26-84b8-4834fd150d71 (1)

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,420 questions
{count} votes

Accepted answer
  1. Pauline Mbabu 560 Reputation points Microsoft Employee
    2024-11-05T12:30:37.7066667+00:00

    Hello @Trent Nolin ,
    Thank you for your question.
    I can see that you have already tried the steps provided on this troubleshooting guide doc and the error is persistent. https://zcusa.951200.xyz/en-us/defender-endpoint/troubleshoot-onboarding.

    You can attempt these steps below to Help resolve the issue:

    1. Get values of these registry keys

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus

    1. Change the values of these registry keys:

    HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus  "GeneralizationState" DWORD value to 7"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State  ImageState to “IMAGE_STATE_COMPLETE”

    Also, the State information is saved in %WINDIR%\Setup\State\State.ini

    If the registry change (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State) is not persistent, then try changing the machine state in State.ini file and test.

    With the above changes, reboot the machine and ensure test.

    I hope this helps to resolve your issue.
    If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.